{"id":"CVE-2026-104867","kind":"vulnerability","aliases":["CVE-2026-104867"],"related":[],"title":"Immich: any logged-in user can see another user's photo activity counts","description":"Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/{id}/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission without an admin-route requirement, and UserAdminService.getCalendarHeatmap in server/src/services/user-admin.service.ts does not compare the authenticated user with the requested user identifier or perform a separate access check. Any authenticated non-admin user can therefore request another account's upload or capture-date activity heatmap for an arbitrary date range. AssetRepository.getCalendarHeatmap in server/src/repositories/asset.repository.ts filters by owner, date, and deletion state but not visibility, so the returned daily counts and total count include archived and locked assets. The route exposes counts and activity dates but does not return asset metadata or content, and it does not affect integrity or availability. This issue is fixed in version 3.2.0.","summary":"Immich versions 3.0.0 through 3.2.0 let any authenticated non-admin user request another account's daily upload or capture-date activity heatmap. The returned counts include archived and locked assets, though no asset metadata or content is exposed.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["immich","package","photo-management","self-hosted"],"not_affected_if":["single-user-instance","version-3.2.0-or-later"],"how_to_check":"- Check the Immich server version and confirm whether it is `3.0.0` or later and before `3.2.0`\n- Review whether multiple non-admin user accounts exist on the instance","fix":"- Upgrade Immich to `3.2.0`","status":"open","published_at":"2026-11-05T17:17:32+00:00","first_seen_at":"2026-11-05T17:40:03+00:00","triaged_at":"2026-11-05T17:42:39+00:00","updated_at":"2026-11-05T17:42:39+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T17:42:39Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Immich to `3.2.0`","reach":"network","title":"Immich: any logged-in user can see another user's photo activity counts","impact":"low","summary":"Immich versions 3.0.0 through 3.2.0 let any authenticated non-admin user request another account's daily upload or capture-date activity heatmap. The returned counts include archived and locked assets, though no asset metadata or content is exposed.","audience":"businesses","category":"package","nicknames":[],"who_cares":["immich","self-hosted","photo-management"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Other users' daily photo activity counts and dates readable by any logged-in user","analyst_note":"","how_to_check":"- Check the Immich server version and confirm whether it is `3.0.0` or later and before `3.2.0`\n- Review whether multiple non-admin user accounts exist on the instance","plain_action":"","needs_analyst":false,"not_affected_if":["version-3.2.0-or-later","single-user-instance"],"who_is_affected":"Self-hosted Immich servers running versions from 3.0.0 up to but not including 3.2.0 with more than one user account are exposed. Any logged-in user, not only admins, can query the calendar heatmap endpoint for other accounts. Single-user instances or servers already on 3.2.0 or later are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000707,"input_tokens":4501,"output_tokens":514,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-104867':17A,20A '-2026':16A,19A '/api/admin/users':89C '/calendar-heatmap':91C '3.0.0':31B,84C '3.2.0':33B,86C,206C 'access':125C 'account':43B,137C 'activ':13A,51B,144C,182C 'admin':39B,103C,131C 'admin-rout':102C 'affect':196C 'anoth':9A,42B,136C 'arbitrari':148C 'archiv':57B,173C 'asset':60B,63B,176C,188C 'assetrepository.getcalendarheatmap':151C 'authent':36B,114C,128C 'avail':199C 'captur':49B,142C 'capture-d':48B,141C 'check':126C 'compar':112C 'content':66B,191C 'count':14A,55B,168C,171C,180C 'cve':15A,18A 'daili':45B,167C 'date':50B,143C,149C,157C,183C 'delet':159C 'expos':68B,179C 'filter':154C 'fix':203C 'get':88C 'heatmap':52B,145C 'high':73C 'high-perform':72C 'host':28B,77C 'id':90C 'identifi':120C 'immich':1A,21B,29B,69C 'includ':56B,172C 'integr':197C 'issu':201C 'let':34B 'lock':59B,175C 'log':4A 'logged-in':3A 'manag':25B,81C 'metadata':64B,189C 'non':38B,130C 'non-admin':37B,129C 'ordinari':97C 'owner':156C 'packag':22B 'perform':74C,122C 'permiss':99C 'permission.userread':98C 'photo':12A,24B,78C 'photo-manag':23B 'rang':150C 'request':41B,118C,135C 'requir':105C 'return':54B,166C,187C 'rout':92C,104C,178C 'see':8A 'self':27B,76C 'self-host':26B,75C 'separ':124C 'server/src/controllers/user-admin.controller.ts':94C 'server/src/repositories/asset.repository.ts':153C 'server/src/services/user-admin.service.ts':109C 'solut':82C 'state':160C 'therefor':134C 'though':61B 'total':170C 'upload':46B,139C 'use':95C 'user':6A,10A,40B,115C,119C,132C 'useradminservice.getcalendarheatmap':107C 'version':30B,205C 'video':80C 'visibl':163C 'without':100C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Immich servers running versions from 3.0.0 up to but not including 3.2.0 with more than one user account are exposed. Any logged-in user, not only admins, can query the calendar heatmap endpoint for other accounts. Single-user instances or servers already on 3.2.0 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["immich","medium","package","photomanagement","selfhosted"],"campaign_type":null,"first_public_at":"2026-10-13T15:26:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104867","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104867","severity":null,"published_at":"2026-11-05T17:17:32+00:00","modified_at":"2026-11-05T17:17:32+00:00","first_seen_at":"2026-11-05T17:40:03+00:00","fetched_at":"2026-11-05T17:40:03+00:00","note":null}],"documents":[{"id":78080,"url":"https://github.com/immich-app/immich/commit/6c86d39f6d9955fc5e2998ce808e6f794b5ebd5e","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":78081,"url":"https://github.com/immich-app/immich/commit/f68815e35f4677dbc3a8ff58a7402952672dfceb","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":49969,"url":"https://github.com/immich-app/immich/releases/tag/v3.2.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":78083,"url":"https://github.com/immich-app/immich/security/advisories/GHSA-g82p-27g4-864h","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-13T15:26:42+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}