CVE-2026-59258 | immich before 3.0.3 contains a broken access control vulnera… | CVSS 8.3 HIGH

Description

immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can demote the album owner to editor and promote themselves to owner in sequential requests, gaining full control including deletion and eviction capabilities.

Metadata

CVE ID: CVE-2026-59258
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-04 12:17 UTC
Published: 2026-07-15 17:03 UTC
Last updated: 2026-07-15 18:13 UTC
Primary CWE: CWE-863
Incorrect Authorization
Vendor / Product: immich-app / immich
Sources: cve.org · NVD

Severity & Metrics

8.3 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
immich-app	immich	—	0 < 3.0.3

Weakness (CWE)

CWE	Source	Description
CWE-863	cna	Incorrect Authorization

CVSS scores (2)

Score	Severity	Version	Source	Vector
8.3	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
7.2	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

References (5)

Researcher Disclosure https://github.com/immich-app/immich/issues/29857
Release Notes https://github.com/immich-app/immich/releases/tag/v3.0.3
Pull Request https://github.com/immich-app/immich/pull/29883
Patch Commit https://github.com/immich-app/immich/commit/84dff19ca9a467752d848ff54763d62c04ebf960
https://www.vulncheck.com/advisories/immich-shared-album-editor-ownership-takeover-via-updateuser