Immich-app Immich vulnerabilities

• immich-app immich Immich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints CVE-2026-77439 8.8 HighNovember 5, 2026
• immich-app immich Immich calendar heatmap endpoint discloses cross-user activity through broken access control CVE-2026-104867 4.3 MediumNovember 5, 2026
• immich-app immich Immich: A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API CVE-2026-119330 3.5 LowOctober 30, 2026
• immich-app immich Immich: Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers CVE-2026-119329 4.3 MediumOctober 30, 2026
• immich-app immich Immich: Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service CVE-2026-119328 6.5 MediumOctober 30, 2026
• immich-app immich Immich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadata CVE-2026-108165 5.3 MediumOctober 10, 2026
• immich-app immich Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE CVE-2026-105764 7.7 HighOctober 5, 2026
• immich-app immich immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization CVE-2026-103532 6.9 MediumOctober 1, 2026
• immich-app immich Immich Locked Assets Remain Readable Through Albums and Shared Links CVE-2026-82272 7.1 HighAugust 28, 2026
• immich-app immich immich < 3.0.3 Shared Album Editor Ownership Takeover via updateUser CVE-2026-59258 7.2 HighJuly 15, 2026
• immich-app immich immich: One-click account takeover via XSS in login page continue redirect CVE-2026-53662 9.6 CriticalJune 23, 2026
• futo immich immich: Open Redirect via Shared Album name CVE-2026-40096 5.1 MediumApril 14, 2026
• futo immich immich has Stored XSS via OCR Text in 360° Panorama Viewer CVE-2026-35455 Public exploit 7.3 HighApril 8, 2026
• futo immich immich-server: Insecure Transmission of Authentication Credentials via Password Parameter in HTTP Request Query String When Accessing Shared Albums CVE-2026-25118 6.3 MediumApril 3, 2026
• futo immich immich API Key Privilege Escalation vulnerability CVE-2026-23896 7.2 HighJanuary 29, 2026
• immich-app immich immich allows account hijacking through oauth2 CVE-2025-43856 7.3 HighJuly 11, 2025