Unauthenticated Endpoint Vulnerability in Immich Photo Management Solution

CVE-2026-119328

What is CVE-2026-119328?

The Immich photo management solution had a vulnerability in its machine-learning endpoint that allowed unauthenticated attackers with network access to manipulate security-sensitive parameters. Specifically, the service accepted options for model construction without proper restrictions, enabling attackers to designate a writable cache directory. This could lead to unauthorized file modification or deletion in data locations, depending on user permissions. A fix has been implemented in version 3.3.0 to address this issue and secure the model loading process.

References