CVE-2026-59258CWE-863broken-access-control

CVE-2026-59258

High · published July 15, 2026

CVSS v3.1
8.3
EPSS
0%
Percentile
38.6
In the wild
Unconfirmed
What it is

immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can demote the album owner to editor and promote themselves to owner in sequential requests, gaining full control including deletion and eviction capabilities.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00456 · 38.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-07-15T22:16Z
References (5)
https://github.com/immich-app/immich/commit/84dff19ca9a467752d848ff54763d62c04ebf960 · [email protected]https://github.com/immich-app/immich/issues/29857 · [email protected]https://github.com/immich-app/immich/pull/29883 · [email protected]https://github.com/immich-app/immich/releases/tag/v3.0.3 · [email protected]https://www.vulncheck.com/advisories/immich-shared-album-editor-ownership-takeover-via-updateuser · [email protected]
EPSS history
Timeline
  • 15 JUL 17:03Z
    immich < 3.0.3 Shared Album Editor Ownership Takeover via updateUser
    cvelistv5