CVE-2026-77439: falha de alta gravidade em immich-app immich
Immich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8epss 0.6%
Immich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing owner's role because album member role updates do not protect the owner from modification. By demoting the owner and then promoting themselves, an editor can take ownership of the album, remove the original owner, and delete the album. This vulnerability is fixed in version 3.0.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
immich-app · immichCVEs relacionadas — immich-app immich
No mesmo produto, das mais perigosas para as menos.
CVE-2026-25118MEDIUMimmich-server: Insecure Transmission of Authentication Credentials via Password Parameter in HTTP Request Query String When Accessing Shared AlbumsEPSS 0.5%CVE-2026-59258HIGHimmich < 3.0.3 Shared Album Editor Ownership Takeover via updateUserEPSS 0.5%CVE-2026-119328MEDIUMImmich: Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning serviceEPSS 0.4%CVE-2026-82272HIGHImmich Locked Assets Remain Readable Through Albums and Shared LinksEPSS 0.4%CVE-2025-43856HIGHimmich allows account hijacking through oauth2EPSS 0.4%CVE-2026-23896HIGHimmich API Key Privilege Escalation vulnerabilityEPSS 0.4%