---
id: "CVE-2026-104867"
kind: "vulnerability"
aliases: ["CVE-2026-104867"]
title: "Immich: any logged-in user can see another user's photo activity counts"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["immich", "package", "photo-management", "self-hosted"]
not_affected_if: ["single-user-instance", "version-3.2.0-or-later"]
published_at: "2026-11-05T17:17:32+00:00"
first_seen_at: "2026-11-05T17:40:03+00:00"
updated_at: "2026-11-05T17:42:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104867", "first_seen_at": "2026-11-05T17:40:03+00:00"}]
exploit_sources: []
---

# Immich: any logged-in user can see another user's photo activity counts

Immich versions 3.0.0 through 3.2.0 let any authenticated non-admin user request another account's daily upload or capture-date activity heatmap. The returned counts include archived and locked assets, though no asset metadata or content is exposed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Immich server version and confirm whether it is `3.0.0` or later and before `3.2.0`
- Review whether multiple non-admin user accounts exist on the instance

## Fix

- Upgrade Immich to `3.2.0`

## Timeline

- 2026-11-05T17:40:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104867

## Documents

- [advisory] Vendor advisory: github.com https://github.com/immich-app/immich/security/advisories/GHSA-g82p-27g4-864h
- [fix] Patch: github.com https://github.com/immich-app/immich/commit/6c86d39f6d9955fc5e2998ce808e6f794b5ebd5e
- [fix] Patch: github.com https://github.com/immich-app/immich/commit/f68815e35f4677dbc3a8ff58a7402952672dfceb
- [fix] Release notes: github.com https://github.com/immich-app/immich/releases/tag/v3.2.0

## From the sources

Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/{id}/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission without an admin-route requirement, and UserAdminService.getCalendarHeatmap in server/src/services/user-admin.service.ts does not compare the authenticated user with the requested user identifier or perform a separate access check. Any authenticated non-admin user can therefore request another account's upload or capture-date activity heatmap for an arbitrary date range. AssetRepository.getCalendarHeatmap in server/src/repositories/asset.repository.ts filters by owner, date, and deletion state but not visibility, so the returned daily counts and total count include archived and locked assets. The route exposes counts and activity dates but does not return asset metadata or content, and it does not affect integrity or availability. This issue is fixed in version 3.2.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_