Immich-app Immich
7 CVEs affecting Immich-app Immich. Latest disclosed: 2026-07-15. Critical: 1, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-53662 | Critical | 9.6 | 2026-06-23 | immich is a high performance self-hosted photo and video management solution. From commit 4ffa26c9 until 4eb1003, a reflected cross-site scripting (XSS) vulner… |
CVE-2026-59258 | High | 8.3 | 2026-07-15 | immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify memb… |
CVE-2026-25118 | High | 7.5 | 2026-04-03 | immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable to credential disclo… |
CVE-2026-35455 | High | 7.3 | 2026-04-08 | immich is a high performance self-hosted photo and video management solution. Prior to 2.7.0, sStored Cross-Site Scripting (XSS) in the 360° panorama viewer al… |
CVE-2026-23896 | High | 7.2 | 2026-01-29 | immich is a high performance self-hosted photo and video management solution. Prior to version 2.5.0, API keys can escalate their own permissions by calling th… |
CVE-2026-40096 | Medium | 5.4 | 2026-04-15 | immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open redirect vulnerability in the shared albu… |
CVE-2025-43856 | | 2025-07-11 | immich is a high performance self-hosted photo and video management solution. Prior to 1.132.0, immich is vulnerable to account hijacking through oauth2, becau… |