PT-2026-60251 · Git+1 · Immich

George Chen · CVE-2026-59258 · Published 2026-07-15 · Updated 2026-07-15

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions immich versions prior to 3.0.3

Description Broken access control exists in the 'PUT /albums/:id/user/:userId' endpoint. This issue allows users with editor permissions on a shared album to modify member roles because owner-only restrictions are not properly enforced. An attacker with editor access can execute sequential requests to demote the album owner to an editor and promote themselves to the owner role, granting them full control over the album, including the ability to delete content and evict other members.

Recommendations Update to version 3.0.3 or later. Restrict access to the 'PUT /albums/:id/user/:userId' endpoint to prevent unauthorized role modifications.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-59258

Affected Products

Immich

References · 9

• 🔥 https://github.com/immich-app/immich/issues/29857 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59258.json · Exploit
• https://github.com/immich-app/immich/commit/84dff19ca9a467752d848ff54763d62c04ebf960 · Patch
• https://osv.dev/vulnerability/CVE-2026-59258 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-59258 · Security Note
• https://github.com/immich-app/immich/releases/tag/v3.0.3 · Note
• https://github.com/immich-app/immich/pull/29883 · Note
• https://github.com/immich-app/immich · Note
• https://vulncheck.com/advisories/immich-shared-album-editor-ownership-takeover-via-updateuser · Note