Vulnerability · Published Jul 15, 2026 · Assigned by VulnCheck

CVE-2026-59258immich < 3.0.3 Shared Album Editor Ownership Takeover via updateUser

High 8.3

In plain English

A high-severity incorrect authorization in immich from immich-app. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.5%top 60.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can demote the album owner to editor and promote themselves to owner in sequential requests, gaining full control including deletion and eviction capabilities.

Affected products (as reported)

Vendor	Product	Versions
immich-app	immich	0 – before 3.0.3

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

References

Researcher Disclosure technical-description, exploit, issue-tracking
immich v3.0.3 Release Notes release-notes
Pull Request issue-tracking, patch
Patch Commit patch
https://www.vulncheck.com/advisories/immich-shared-album-editor-ownership-takeover-via-updateuser third-party-advisory