{"id":"CVE-2026-77439","published":"2026-11-05T18:17:10.203","lastModified":"2026-11-05T18:17:10.363","description":"Immich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing owner's role because album member role updates do not protect the owner from modification. By demoting the owner and then promoting themselves, an editor can take ownership of the album, remove the original owner, and delete the album. This vulnerability is fixed in version 3.0.3.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269","CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://github.com/immich-app/immich/commit/84dff19ca9a467752d848ff54763d62c04ebf960","tags":[]},{"url":"https://github.com/immich-app/immich/pull/29883","tags":[]},{"url":"https://github.com/immich-app/immich/releases/tag/v3.0.3","tags":[]},{"url":"https://github.com/immich-app/immich/security/advisories/GHSA-c9mf-h82r-8p4j","tags":[]}],"exploitRefs":[{"url":"https://github.com/immich-app/immich/commit/84dff19ca9a467752d848ff54763d62c04ebf960","tags":[]},{"url":"https://github.com/immich-app/immich/pull/29883","tags":[]},{"url":"https://github.com/immich-app/immich/releases/tag/v3.0.3","tags":[]},{"url":"https://github.com/immich-app/immich/security/advisories/GHSA-c9mf-h82r-8p4j","tags":[]}],"hasPoc":true,"ai":{"summary":"An authenticated user with editor privileges in a shared album can escalate to owner by demoting the current owner and promoting themselves, bypassing role-based access controls due to missing protection on the owner role during member updates.","exploitability":"Requires valid authentication and existing editor-level access to a shared album; low effort for an attacker meeting these conditions.","blast_radius":"An attacker could fully compromise the album by removing the original owner, deleting all content, and gaining full control over the album's data and sharing settings.","remediation":"Upgrade to Immich version 3.0.3 or later, which patches the missing protection on the owner role during album member role updates.","detection":"Monitor for unusual role changes in shared albums—specifically, events where an editor user demotes the owner and promotes themselves; look for consecutive 'album_member_role_updated' log entries with a role change from 'owner' to 'editor' followed by 'editor' to 'owner' by the same user.","tags":["privilege-escalation","role-abuse","shared-album","auth-bypass","web"],"model":"garnet-coder","analyzedAt":"2026-11-06T09:54:10.329Z"}}