immich-app Immich

• CVE-2026-77439 High 8.8 Immich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints 0.6%
• CVE-2026-104867 Medium 4.3 Immich calendar heatmap endpoint discloses cross-user activity through broken access control 0.3%
• CVE-2026-119330 Low 3.5 Immich: A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API 0.2%
• CVE-2026-119329 Medium 4.3 Immich: Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers 0.3%
• CVE-2026-119328 Medium 6.5 Immich: Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service 0.4%
• CVE-2026-108165 Medium 4.3 Immich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadata 0.2%
• CVE-2026-105764 High 7.7 Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE 0.3%
• CVE-2026-103532 Medium 5.3 immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization 0.4%
• CVE-2026-82272 Medium 6.5 Immich Locked Assets Remain Readable Through Albums and Shared Links 0.4%
• CVE-2026-59258 High 8.3 immich < 3.0.3 Shared Album Editor Ownership Takeover via updateUser 0.5%
• CVE-2026-53662 Critical 9.6 immich: One-click account takeover via XSS in login page continue redirect 0.3%
• CVE-2026-40096 Medium 5.1 immich: Open Redirect via Shared Album name 0.2%
• CVE-2026-35455 High 7.3 immich has Stored XSS via OCR Text in 360° Panorama Viewer 0.2%
• CVE-2026-25118 Medium 6.3 immich-server: Insecure Transmission of Authentication Credentials via Password Parameter in HTTP Request Query String When Accessing Shared Albums 0.5%
• CVE-2026-23896 High 7.2 immich API Key Privilege Escalation vulnerability 0.4%
• CVE-2025-43856 High 7.3 immich allows account hijacking through oauth2 0.4%