CVE-2026-77439 · Package
NO FIX YET · SEE WHAT TO DO
Immich is a self-hosted photo and video app. An authenticated user with editor access to a shared album can demote the album owner, promote themselves, then remove the original owner and delete the album.
first public Oct 19, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams and households running a self-hosted Immich server before 3.0.3 where users share albums with editor access. Users who only view shared albums, or who run a patched version, are not exposed to this flaw.
Not affected if no-shared-album-editors, version-3.0.3-or-later
Who cares immich, photo-management, self-hosted
/api/server/version response, and see whether it is below 3.0.3.3.0.3.Immich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing owner's role because album member role updates do not protect the owner from modification. By demoting the owner and then promoting themselves, an editor can take ownership of the album, remove the original owner, and delete the album. This vulnerability is fixed in version 3.0.3.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.