immich-app vulnerabilities

CVEs per yearBy the year they were published

1. 20251
2. 202615

Newest CVEs

• CVE-2026-77439

  Immich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints

  immich-app · immich

  High8.8
• CVE-2026-104867

  Immich calendar heatmap endpoint discloses cross-user activity through broken access control

  immich-app · immich

  Medium4.3
• CVE-2026-119330

  Immich: A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API

  immich-app · immich

  Low3.5
• CVE-2026-119329

  Immich: Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers

  immich-app · immich

  Medium4.3
• CVE-2026-119328

  Immich: Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service

  immich-app · immich

  Medium6.5
• CVE-2026-108165

  Immich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadata

  immich-app · immich

  Medium5.3
• CVE-2026-105764

  Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE

  immich-app · immich

  High7.7
• CVE-2026-103532

  immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization

  immich-app · Immich

  Medium6.9
• CVE-2026-82272

  Immich Locked Assets Remain Readable Through Albums and Shared Links

  immich-app · immich

  High7.1
• CVE-2026-59258

  immich < 3.0.3 Shared Album Editor Ownership Takeover via updateUser

  immich-app · immich

  High7.2