Immich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Immich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing owner's role because album member role updates do not protect the owner from modification. By demoting the owner and then promoting themselves, an editor can take ownership of the album, remove the original owner, and delete the album. This vulnerability is fixed in version 3.0.3.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…immich/security/advisories/GHSA-c9mf-h82r-8p4j Diğer
• github.com/immich-app/immich/pull/29883 Diğer
• github.com/…ommit/84dff19ca9a467752d848ff54763d62c04ebf960 Diğer
• github.com/immich-app/immich/releases/tag/v3.0.3 Diğer

Kayıt geçmişi

1. 5 Kas 2026 20:25Yayımlandı

İlgili açıklar

• 4,3 CVE-2026-104867Immich calendar heatmap endpoint discloses cross-user activity through broken access control
• 3,5 CVE-2026-119330Immich: A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API
• 4,3 CVE-2026-119329Immich: Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers
• 6,5 CVE-2026-119328Immich: Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service
• 7,1 CVE-2026-100364SuiteCRM V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership Hijack
• 6,5 CVE-2026-69144SuiteCRM: Authorization Bypass via Document Revision ID Confusion in download.php