---
id: "CVE-2026-77439"
kind: "vulnerability"
aliases: ["CVE-2026-77439"]
title: "Immich: shared album editors can take over album ownership and delete it"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["immich", "package", "photo-management", "self-hosted"]
not_affected_if: ["no-shared-album-editors", "version-3.0.3-or-later"]
published_at: "2026-11-05T18:17:10+00:00"
first_seen_at: "2026-11-05T18:40:10+00:00"
updated_at: "2026-11-05T18:40:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77439", "first_seen_at": "2026-11-05T18:40:10+00:00"}]
exploit_sources: []
---

# Immich: shared album editors can take over album ownership and delete it

Immich is a self-hosted photo and video app. An authenticated user with editor access to a shared album can demote the album owner, promote themselves, then remove the original owner and delete the album.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Immich server version, for example in the admin settings or the server's `/api/server/version` response, and see whether it is below `3.0.3`.
- Review which users have editor access on shared albums.

## Fix

- Immich: upgrade to `3.0.3`.

## Timeline

- 2026-11-05T18:40:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77439

## Documents

- [advisory] Vendor advisory: github.com https://github.com/immich-app/immich/security/advisories/GHSA-c9mf-h82r-8p4j
- [fix] Patch: github.com https://github.com/immich-app/immich/commit/84dff19ca9a467752d848ff54763d62c04ebf960
- [fix] Release notes: github.com https://github.com/immich-app/immich/releases/tag/v3.0.3

## From the sources

Immich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing owner's role because album member role updates do not protect the owner from modification. By demoting the owner and then promoting themselves, an editor can take ownership of the album, remove the original owner, and delete the album. This vulnerability is fixed in version 3.0.3.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_