High · published January 29, 2026
⚡ An API key can turn rogue and promote itself to admin status! Before version 2.5.0, this vulnerability in immich lets a low-privilege key grant itself full system access, like a temp employee being handed the master key to the office. 🔥 This flaw is like a receptionist who suddenly decides they can access the boss's office without permission — they just call up the manager and request the upgrade. It seems innocent enough until chaos ensues! An attacker with a low-privilege API key could easily escalate their permissions and take over the system, making this a dangerous situation. They could manipulate data, change settings, and potentially compromise user privacy. Imagine the mess if a bad actor suddenly had full control over your photo and video management system!
This flaw is like a receptionist who suddenly decides they can access the boss's office without permission — they just call up the manager and request the upgrade. It seems innocent enough until chaos ensues! This vulnerability allows an API key to call the update endpoint and escalate its own permissions, effectively granting itself full administrative access without proper authorization checks.
An attacker with a low-privilege API key could easily escalate their permissions and take over the system, making this a dangerous situation. They could manipulate data, change settings, and potentially compromise user privacy. Imagine the mess if a bad actor suddenly had full control over your photo and video management system! Update immich to version 2.5.0 immediately to close this security loophole. Additionally, audit your API keys to ensure they follow the principle of least privilege and are only assigned necessary permissions. Keep an eye on your access logs for any suspicious activity as well! You've got this! Take these steps to fortify your system and keep your media safe. 🛡️