Role Modification Vulnerability in Immich Photo Management Solution

CVE-2026-77439

What is CVE-2026-77439?

Immich, a self-hosted photo and video management platform, contains a vulnerability that allows authenticated users with editor access to alter the roles of other users in shared albums. Specifically, an editor can demote the original owner and elevate their own role to take ownership, leading to unauthorized deletion or modification of the album content. This security issue has been addressed in version 3.0.3 of the product. Users are advised to upgrade to the latest version to ensure the integrity and protection of their data.

References