Vulnerability · Published Nov 5, 2026 · Assigned by GitHub_M
CVE-2026-104867Immich calendar heatmap endpoint discloses cross-user activity through broken access control
Medium 4.3
In plain English
A medium-severity improper access control in immich from immich-app. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Official description
Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/{id}/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission without an admin-route requirement, and UserAdminService.getCalendarHeatmap in server/src/services/user-admin.service.ts does not compare the authenticated user with the requested user identifier or perform a separate access check. Any authenticated non-admin user can therefore request another account's upload or capture-date activity heatmap for an arbitrary date range. AssetRepository.getCalendarHeatmap in server/src/repositories/asset.repository.ts filters by owner, date, and deletion state but not visibility, so the returned daily counts and total count include archived and locked assets. The route exposes counts and activity dates but does not return asset metadata or content, and it does not affect integrity or availability. This issue is fixed in version 3.2.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| immich-app | immich | >= 3.0.0, < 3.2.0 |
Weakness: CWE-284, CWE-639, CWE-1220 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/immich-app/immich/security/advisories/GHSA-g82p-27g4-864h x_refsource_CONFIRM
- https://github.com/immich-app/immich/pull/30310 x_refsource_MISC
- https://github.com/immich-app/immich/commit/6c86d39f6d9955fc5e2998ce808e6f794b5ebd5e x_refsource_MISC
- https://github.com/immich-app/immich/commit/f68815e35f4677dbc3a8ff58a7402952672dfceb x_refsource_MISC
- https://github.com/immich-app/immich/releases/tag/v3.2.0 x_refsource_MISC