{"id":"CVE-2026-77439","kind":"vulnerability","aliases":["CVE-2026-77439"],"related":[],"title":"Immich: shared album editors can take over album ownership and delete it","description":"Immich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing owner's role because album member role updates do not protect the owner from modification. By demoting the owner and then promoting themselves, an editor can take ownership of the album, remove the original owner, and delete the album. This vulnerability is fixed in version 3.0.3.","summary":"Immich is a self-hosted photo and video app. An authenticated user with editor access to a shared album can demote the album owner, promote themselves, then remove the original owner and delete the album.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["immich","package","photo-management","self-hosted"],"not_affected_if":["no-shared-album-editors","version-3.0.3-or-later"],"how_to_check":"- Check the Immich server version, for example in the admin settings or the server's `/api/server/version` response, and see whether it is below `3.0.3`.\n- Review which users have editor access on shared albums.","fix":"- Immich: upgrade to `3.0.3`.","status":"open","published_at":"2026-11-05T18:17:10+00:00","first_seen_at":"2026-11-05T18:40:10+00:00","triaged_at":"2026-11-05T18:40:20+00:00","updated_at":"2026-11-05T18:40:20+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T18:40:20Z","model":"claude-haiku-5-5","output":{"fix":"- Immich: upgrade to `3.0.3`.","reach":"network","title":"Immich: shared album editors can take over album ownership and delete it","impact":"medium","summary":"Immich is a self-hosted photo and video app. An authenticated user with editor access to a shared album can demote the album owner, promote themselves, then remove the original owner and delete the album.","audience":"businesses","category":"package","nicknames":[],"who_cares":["immich","self-hosted","photo-management"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker takes album ownership and deletes the album for everyone","analyst_note":"","how_to_check":"- Check the Immich server version, for example in the admin settings or the server's `/api/server/version` response, and see whether it is below `3.0.3`.\n- Review which users have editor access on shared albums.","plain_action":"","needs_analyst":false,"not_affected_if":["version-3.0.3-or-later","no-shared-album-editors"],"who_is_affected":"Teams and households running a self-hosted Immich server before 3.0.3 where users share albums with editor access. Users who only view shared albums, or who run a patched version, are not exposed to this flaw.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000656,"input_tokens":4276,"output_tokens":457,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-77439':14A,17A '3.0.3':75C,135C 'access':41B,81C 'album':3A,8A,45B,49B,61B,85C,94C,120C,128C 'app':35B 'authent':37B,77C 'chang':87C 'cve':12A,15A 'delet':11A,59B,126C 'demot':47B,106C 'editor':4A,40B,80C,114C 'exist':89C 'fix':132C 'host':25B,31B,67C 'immich':1A,18B,26B,62C 'manag':22B,71C 'member':95C 'modif':104C 'origin':56B,123C 'owner':50B,57B,90C,102C,108C,124C 'ownership':9A,117C 'packag':19B 'photo':21B,32B,68C 'photo-manag':20B 'prior':73C 'promot':51B,111C 'protect':100C 'remov':54B,121C 'role':92C,96C 'self':24B,30B,66C 'self-host':23B,29B,65C 'share':2A,44B,84C 'solut':72C 'take':6A,116C 'updat':97C 'user':38B,78C 'version':134C 'video':34B,70C 'vulner':130C","nicknames":[],"mitigations":[],"who_affected":"Teams and households running a self-hosted Immich server before 3.0.3 where users share albums with editor access. Users who only view shared albums, or who run a patched version, are not exposed to this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","immich","package","photomanagement","selfhosted"],"campaign_type":null,"first_public_at":"2026-10-19T14:16:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77439","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77439","severity":null,"published_at":"2026-11-05T18:17:10+00:00","modified_at":"2026-11-05T18:17:10+00:00","first_seen_at":"2026-11-05T18:40:10+00:00","fetched_at":"2026-11-05T18:40:10+00:00","note":null}],"documents":[{"id":78702,"url":"https://github.com/immich-app/immich/commit/84dff19ca9a467752d848ff54763d62c04ebf960","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":78703,"url":"https://github.com/immich-app/immich/releases/tag/v3.0.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":78704,"url":"https://github.com/immich-app/immich/security/advisories/GHSA-c9mf-h82r-8p4j","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-19T14:16:09+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}