CVE-2026-104867 · Package
NO FIX YET · SEE WHAT TO DO
Immich versions 3.0.0 through 3.2.0 let any authenticated non-admin user request another account's daily upload or capture-date activity heatmap. The returned counts include archived and locked assets, though no asset metadata or content is exposed.
first public Oct 13, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted Immich servers running versions from 3.0.0 up to but not including 3.2.0 with more than one user account are exposed. Any logged-in user, not only admins, can query the calendar heatmap endpoint for other accounts. Single-user instances or servers already on 3.2.0 or later are not affected.
Not affected if single-user-instance, version-3.2.0-or-later
Who cares immich, photo-management, self-hosted
3.0.0 or later and before 3.2.03.2.0Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/{id}/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission without an admin-route requirement, and UserAdminService.getCalendarHeatmap in server/src/services/user-admin.service.ts does not compare the authenticated user with the requested user identifier or perform a separate access check. Any authenticated non-admin user can therefore request another account's upload or capture-date activity heatmap for an arbitrary date range. AssetRepository.getCalendarHeatmap in server/src/repositories/asset.repository.ts filters by owner, date, and deletion state but not visibility, so the returned daily counts and total count include archived and locked assets. The route exposes counts and activity dates but does not return asset metadata or content, and it does not affect integrity or availability. This issue is fixed in version 3.2.0.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.