Vulnerabilidades de Immich-app
CVEs publicadas que afetam produtos de Immich-app: 8 registro(s), com severidade, exploração e correções.
CVE-2026-108165
Média · 4.3
CWE-862 10/10/2026
Immich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadata
Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST /api/sync/stream with PartnerAssetsV2 and PartnerAssetExifsV1 types to obtain GPS coordinates, capture times, descriptions and camera details.
CVE-2026-105764
Alta · 7.7
CWE-94 05/10/2026
Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE
Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell through to ImageMagick, where attacker-controlled <image href> values reached unrestricted MSL and VIDEO coder operations. By storing one crafted asset and referencing its path from a second delayed-marker SVG, an attacker could execute code in the immich-server container when thumbnail processing ran. This issue is fixed in version 3.2.4.
CVE-2026-59258
Alta · 8.3
CWE-863 15/07/2026
immich < 3.0.3 Shared Album Editor Ownership Takeover via updateUser
immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can demote the album owner to editor and promote themselves to owner in sequential requests, gaining full control including deletion and eviction capabilities.
CVE-2026-53662
Crítica · 9.6
CWE-79 23/06/2026
Immich: XSS refletido na página de login permite tomada de conta
immich é uma solução de gerenciamento de fotos e vídeos autohospedada de alto desempenho. Desde o commit 4ffa26c9 até o commit 4eb1003, uma vulnerabilidade de cross-site scripting (XSS) refletido na página /auth/login permite que um atacante comprometa totalmente a conta de qualquer usuário autenticado com um único clique em um link. O parâmetro de consulta continue é lido da URL e repassado ao redirect() do SvelteKit sem qualquer validação de esquema ou origem, permitindo que JavaScript controlado pelo atacante seja executado dentro da origem do Immich. A carga (payload) então usa a sessão existente da vítima para gerar uma chave de API com todas as permissões na conta dela, levando a tomada de conta persistente. Esta vulnerabilidade está corrigida no commit 4eb1003.
CVE-2026-40096
Média · 5.4
CWE-79 15/04/2026
immich: Open Redirect via Shared Album name
immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open redirect vulnerability in the shared album functionality, where the album name is inserted unsanitized into a <meta> tag in api.service.ts. A registered attacker can create a shared album with a crafted name containing 0;url=https://attackersite.com" http-equiv="refresh, which when rendered in the <meta property="og:title"> tag causes the victim's browser to redirect to an attacker-controlled site upon opening the share link. This facilitates phishing attacks, as the attacker could host a modified version of immich that collects login credentials from victims who believe they need to authenticate to view the shared album. This issue has been fixed in version 2.7.3.
CVE-2026-35455
Média · 5.4
CWE-79 08/04/2026
immich has Stored XSS via OCR Text in 360° Panorama Viewer
immich is a high performance self-hosted photo and video management solution. Prior to 2.7.0, sStored Cross-Site Scripting (XSS) in the 360° panorama viewer allows any authenticated user to execute arbitrary JavaScript in the browser of any other user who views the malicious panorama with the OCR overlay enabled. The attacker uploads an equirectangular image containing crafted text; OCR extracts it, and the panorama viewer renders it via innerHTML without sanitization. This enables session hijacking (via persistent API key creation), private photo exfiltration, and access to GPS location history and face biometric data. This vulnerability is fixed in 2.7.0.
CVE-2026-25118
Alta · 7.5
CWE-598 03/04/2026
immich-server: Insecure Transmission of Authentication Credentials via Password Parameter in HTTP Request Query String When Accessing Shared Albums
immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable to credential disclosure when a user authenticates to a shared album. During the authentication process, the application transmits the album password within the URL query parameters in a GET request to /api/shared-links/me. This exposes the password in browser history, proxy and server logs, and referrer headers, allowing unintended disclosure of authentication credentials. The impact of this vulnerability is the potential compromise of shared album access and unauthorized exposure of sensitive user data. This issue has been patched in version 2.6.0.
CVE-2026-23896
Alta · 8.8
CWE-269 29/01/2026
immich API Key Privilege Escalation vulnerability
immich is a high performance self-hosted photo and video management solution. Prior to version 2.5.0, API keys can escalate their own permissions by calling the update endpoint, allowing a low-privilege API key to grant itself full administrative access to the system. Version 2.5.0 fixes the issue.