Advisories · Technology
immich.
Every CVE that names immich among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.8 High
Immich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints
- immich
- Privilege escalation
- Broken access control
- CVSS 4.3 Medium
Immich calendar heatmap endpoint discloses cross-user activity through broken access control
- immich
- Broken access control
- CWE-1220
- CVSS 3.5 Low
Immich: A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API
- immich
- Broken access control
- CVSS 4.3 Medium
Immich: Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers
- immich
- Broken access control
- CVSS 6.5 Medium
Immich: Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service
- immich
- Path traversal
- CVSS 5.3 Medium
Immich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadata
- immich
- Broken access control
- CVSS 7.7 High
Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE
- immich
- Code injection
- CVSS 6.9 Medium
immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization
- Immich
- Privilege escalation
- Broken access control
- CVSS 7.1 High
Immich Locked Assets Remain Readable Through Albums and Shared Links
- immich
- Broken access control
- CVSS 7.2 High
immich < 3.0.3 Shared Album Editor Ownership Takeover via updateUser
- immich
- Broken access control
- CVSS 9.6 CriticalCritical · CVSS 9+
immich: One-click account takeover via XSS in login page continue redirect
- immich
- Cross-site scripting (XSS)
- Open redirect
- CVSS 5.1 Medium
immich: Open Redirect via Shared Album name
- immich
- Cross-site scripting (XSS)
- Open redirect
- CVSS 7.3 High
immich has Stored XSS via OCR Text in 360° Panorama Viewer
- immich
- Cross-site scripting (XSS)
- CVSS 6.3 Medium
immich-server: Insecure Transmission of Authentication Credentials via Password Parameter in HTTP Request Query String When Accessing Shared Albums
- immich
- CWE-598
- CVSS 7.2 High
immich API Key Privilege Escalation vulnerability
- immich
- Privilege escalation
- CVSS 7.3 High
immich allows account hijacking through oauth2
- immich
- Authentication bypass