CVE-2026-59258

immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can demote the album owner to editor and promote themselves to owner in sequential requests, gaining full control including deletion and eviction capabilities.

CVSS v3 8.3 HIGH

8.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/immich-app/immich/commit/84dff19ca9a467752d848ff54763d62c04ebf960
https://github.com/immich-app/immich/issues/29857
https://github.com/immich-app/immich/pull/29883
https://github.com/immich-app/immich/releases/tag/v3.0.3
https://www.vulncheck.com/advisories/immich-shared-album-editor-ownership-takeover-via-updateuser

Configurations

No configuration.

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) immich antes de la versión 3.0.3 contiene una vulnerabilidad de control de acceso roto en el endpoint PUT /albums/:id/user/:userId que permite a los editores de álbumes compartidos modificar roles de miembros sin restricciones de solo propietario. Atacantes con acceso de editor pueden degradar al propietario del álbum a editor y ascenderse a sí mismos a propietario en solicitudes secuenciales, obteniendo control total incluyendo capacidades de eliminación y expulsión.

Information

Published : 2026-07-15 18:16

Updated : 2026-10-24 21:10

NVD link : CVE-2026-59258

Mitre link : CVE-2026-59258

CVE.ORG link : CVE-2026-59258

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-59258", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59258", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T18:13:13.810826Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 5.5, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/immich-app/immich", "vendor": "immich-app", "product": "immich", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.3", "versionType": "semver"}], "packageURL": "pkg:github/immich-app/immich", "defaultStatus": "unaffected"}]}], "published": "2026-07-15T18:16:49.150", "references": [{"url": "https://github.com/immich-app/immich/commit/84dff19ca9a467752d848ff54763d62c04ebf960", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/immich-app/immich/issues/29857", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/immich-app/immich/pull/29883", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/immich-app/immich/releases/tag/v3.0.3", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/immich-shared-album-editor-ownership-takeover-via-updateuser", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can demote the album owner to editor and promote themselves to owner in sequential requests, gaining full control including deletion and eviction capabilities."}, {"lang": "es", "value": "immich antes de la versi\u00f3n 3.0.3 contiene una vulnerabilidad de control de acceso roto en el endpoint PUT /albums/:id/user/:userId que permite a los editores de \u00e1lbumes compartidos modificar roles de miembros sin restricciones de solo propietario. Atacantes con acceso de editor pueden degradar al propietario del \u00e1lbum a editor y ascenderse a s\u00ed mismos a propietario en solicitudes secuenciales, obteniendo control total incluyendo capacidades de eliminaci\u00f3n y expulsi\u00f3n."}], "lastModified": "2026-10-24T21:10:00.130", "sourceIdentifier": "disclosure@vulncheck.com"}