Immich-app vulnerabilities
We track 7 vulnerabilities in Immich-app products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on November 5, 2026.
Latest Immich-app vulnerabilities
- 8.8 High severity
immich: Improper Privilege Management
Immich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing owner's role because album member role updates do not protect the owner from modification. By demoti
- 7.7 High severity
immich: Improper Control of Generation of Code
Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that byp
- 8.3 High severity
immich: Incorrect Authorization
immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can demote the album owner to
- 9.6 Critical severity
immich: Improper Neutralization of Input During Web Page Generation
immich is a high performance self-hosted photo and video management solution. From commit 4ffa26c9 until 4eb1003, a reflected cross-site scripting (XSS) vulnerability on the /auth/login page allows an attacker to fully compromise any authenticated user's accou
- 7.5 High severity
immich: Use of HTTP Request With Sensitive Query String
immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable to credential disclosure when a user authenticates to a shared album. During the authentication process, the application
- 8.8 High severity
immich: Improper Privilege Management
immich is a high performance self-hosted photo and video management solution. Prior to version 2.5.0, API keys can escalate their own permissions by calling the update endpoint, allowing a low-privilege API key to grant itself full administrative access to the
- 7.3 High severity
immich: Incorrect Implementation of Authentication Algorithm
immich is a high performance self-hosted photo and video management solution. Prior to 1.132.0, immich is vulnerable to account hijacking through oauth2, because the state parameter is not being checked. The oauth2 state parameter is similar to a csrf token, s