User Information Exposure in Immich Photo Management by Immich App

CVE-2026-104867

What is CVE-2026-104867?

Immich Photo Management, from versions 3.0.0 to 3.2.0, contains a vulnerability in its GET /api/admin/users/{id}/calendar-heatmap route. This endpoint improperly employs a standard UserRead permission without requisite admin verification, allowing non-admin authenticated users to access another user's upload or activity heatmap for any designated date range. The issue arises because the system does not adequately assess whether the authenticated user matches the requested user identifier nor does it impose a strict access check. Furthermore, while the daily counts and overall totals are filtered by owner, date, and deletion state, they are not restricted by visibility, resulting in the inclusion of archived and locked assets in the response. The exposure does not impact the integrity or availability of the assets but raises significant concerns about user privacy. This vulnerability has been addressed in version 3.2.0.

References