PT-2026-60251 · Immich App · Immich

George Chen · Published 2026-07-15 · Updated 2026-07-15 · CVE-2026-59258

NVD

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can demote the album owner to editor and promote themselves to owner in sequential requests, gaining full control including deletion and eviction capabilities.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-59258

Affected Products

Immich

References · 6

• 🔥 https://github.com/immich-app/immich/issues/29857 · Exploit
• https://github.com/immich-app/immich/commit/84dff19ca9a467752d848ff54763d62c04ebf960 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-59258 · Security Note
• https://github.com/immich-app/immich/pull/29883 · Note
• https://github.com/immich-app/immich/releases/tag/v3.0.3 · Note
• https://vulncheck.com/advisories/immich-shared-album-editor-ownership-takeover-via-updateuser · Note