Immich-App Immich
16 CVEs affecting Immich-App Immich. Latest disclosed: 2026-11-05. Critical: 1, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-53662 | Critical | 9.6 | 2026-06-23 | immich is a high performance self-hosted photo and video management solution. From commit 4ffa26c9 until 4eb1003, a reflected cross-site scripting (XSS) vulner… |
CVE-2026-77439 | High | 8.8 | 2026-11-05 | Immich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing… |
CVE-2026-59258 | High | 8.3 | 2026-07-15 | immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify memb… |
CVE-2026-25118 | High | 7.5 | 2026-04-03 | immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable to credential disclo… |
CVE-2026-35455 | High | 7.3 | 2026-04-08 | immich is a high performance self-hosted photo and video management solution. Prior to 2.7.0, sStored Cross-Site Scripting (XSS) in the 360° panorama viewer al… |
CVE-2026-23896 | High | 7.2 | 2026-01-29 | immich is a high performance self-hosted photo and video management solution. Prior to version 2.5.0, API keys can escalate their own permissions by calling th… |
CVE-2026-119328 | Medium | 6.5 | 2026-10-30 | Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machine-learning /predict endpoint in machine… |
CVE-2026-82272 | Medium | 6.5 | 2026-08-28 | Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain access… |
CVE-2026-40096 | Medium | 5.4 | 2026-04-15 | immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open redirect vulnerability in the shared albu… |
CVE-2026-103532 | Medium | 5.3 | 2026-10-01 | A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the… |
CVE-2026-104867 | Medium | 4.3 | 2026-11-05 | Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/{id}/calendar-heatmap route in s… |
CVE-2026-119329 | Medium | 4.3 | 2026-10-30 | Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers used server/src/services/map.service.ts to a… |
CVE-2026-108165 | Medium | 4.3 | 2026-10-10 | Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Fol… |
CVE-2026-119330 | Low | 3.5 | 2026-10-30 | Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as ind… |
CVE-2026-105764 | | 2026-10-06 | Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumb… | |
CVE-2025-43856 | | 2025-07-11 | immich is a high performance self-hosted photo and video management solution. Prior to 1.132.0, immich is vulnerable to account hijacking through oauth2, becau… |