Description

Immich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing owner's role because album member role updates do not protect the owner from modification. By demoting the owner and then promoting themselves, an editor can take ownership of the album, remove the original owner, and delete the album. This vulnerability is fixed in version 3.0.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-11-05T18:17:10.203Z",
  "pubdate": "2026-11-05T18:17:10.203Z",
  "executiveSummary": "Immich versions prior to 3.0.3 contain an authorization bypass vulnerability within the shared album management module. This flaw allows an authenticated user assigned the 'editor' role to perform unauthorized modifications to the access control settings of a shared album, specifically regarding the primary owner's permissions. By exploiting this oversight, an attacker can modify the roles of other members, effectively demoting the original owner and promoting themselves to the owner position.\nThe vulnerability stems from improper input validation and insufficient server-side authorization checks during role update operations. An attacker with existing editor-level access can manipulate the album's membership configuration to assume full administrative control over the resource. The impact includes unauthorized access to private media, the ability to evict the original owner, and the potential for permanent deletion of shared media assets. This constitutes a severe escalation of privilege within the application context, compromising data integrity and confidentiality for shared albums. Remediation requires upgrading the Immich instance to version 3.0.3 or later, which introduces necessary access control guards to prevent modification of the owner's status.",
  "technicalDetails": "The vulnerability resides in the server-side API logic responsible for handling membership role updates in shared albums. In versions prior to 3.0.3, the application failed to implement a conditional check to exclude the current album owner from being a valid target for role modification requests initiated by authenticated users holding editor privileges.\nThe attack flow proceeds as follows: First, the attacker must hold at least 'editor' access to a shared album. Upon identifying the API endpoint responsible for updating user roles within the album, the attacker crafts a malicious request targeting the album's membership configuration. Because the backend service lacks a validation check to preserve the immutability of the owner's role, the attacker is able to submit an update request that changes the owner's role to a lower privilege level.\nOnce the original owner is demoted, the attacker utilizes their editor permissions to promote their own account to the 'owner' role. With ownership transferred, the attacker gains full administrative control over the album. This post-exploitation state grants the attacker the ability to modify, remove, or delete existing album members, including the original owner. Furthermore, the attacker can then delete the entire shared album, leading to potential data loss if the media is not otherwise backed up.\nThe root cause is an insufficient authorization policy that fails to enforce the principle of least privilege regarding the management of high-privilege account roles. The system incorrectly assumes that only an owner can manage roles, but fails to prevent editors from modifying other users—including the owner—when that validation should be strictly enforced to preserve the owner status. This vulnerability is strictly an authorization issue requiring an authenticated session, meaning it does not expose the instance to unauthenticated attackers. The vulnerability is explicitly fixed in version 3.0.3 by enforcing a strict check that blocks any request attempting to modify the owner's role or status, effectively neutralizing the path for privilege escalation."
}