CVE-2026-59258: Immich Auth Bypass Vulnerability

CVE-2026-59258 Overview

CVE-2026-59258 is a broken access control vulnerability [CWE-863] affecting immich versions prior to 3.0.3. The flaw exists in the PUT /albums/:id/user/:userId endpoint, which fails to enforce owner-only restrictions when updating shared album member roles. Any user granted editor access to a shared album can modify roles for other members, including the album owner. Attackers can chain sequential requests to demote the legitimate owner to editor and promote their own account to owner, gaining full control over the album including asset deletion and member eviction.

Critical Impact
Shared album editors can hijack ownership of any album they access, allowing them to delete all photos, evict the original owner, and take permanent control of shared media collections.

Affected Products

immich versions prior to 3.0.3
immich self-hosted photo and video management server
Deployments exposing shared album functionality to multiple users

Discovery Timeline

2026-07-15 - CVE-2026-59258 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-59258

Vulnerability Analysis

The vulnerability resides in the updateUser method of album.service.ts in the immich server component. The endpoint checks that the caller holds the AlbumShare permission but does not verify that the caller is the album owner. It also fails to reject role changes targeting the current owner. This allows any editor with AlbumShare privileges to modify the role field on any album membership record, including the owner's record.

Exploitation requires only editor-level access to a shared album, which is commonly granted to trusted contacts, family members, or collaborators. Two sequential API calls complete the takeover: one to demote the owner, another to promote the attacker. Once the takeover completes, the original owner loses administrative rights over their own album.

Root Cause

The root cause is a missing authorization check that conflates share permission with owner permission. The requireAccess call validates only that the caller can act on shared album data, not that they hold the exclusive owner role required to change member roles. The patch introduces an explicit check that fetches the album, identifies the owner from albumUsers[0], and rejects any request targeting the owner's user ID.

Attack Vector

An authenticated user with editor privileges on a shared album sends a PUT request to /albums/:id/user/:userId specifying the album owner's user ID and a role payload of editor. A second request targets the attacker's own user ID with a role payload of owner. No user interaction from the victim is required, and the attack executes over the network against any exposed immich instance.

typescript

  async updateUser(auth: AuthDto, id: string, userId: string, dto: UpdateAlbumUserDto): Promise<void> {
    await this.requireAccess({ auth, permission: Permission.AlbumShare, ids: [id] });
+
+    const album = await this.findOrFail(id, userId, { withAssets: false });
+    const owner = album.albumUsers[0];
+
+    if (owner.user.id === userId) {
+      throw new BadRequestException('User is owner');
+    }
+
    await this.albumUserRepository.update({ albumId: id, userId }, { role: dto.role });
  }

Source: GitHub Commit 84dff19 — The patch adds a guard that rejects role update requests when the target user is the album owner.

Detection Methods for CVE-2026-59258

Indicators of Compromise

Unexpected changes to album ownership in the album_users database table where the previous owner's role transitioned to editor.
Sequential PUT /albums/:id/user/:userId requests from a single authenticated session targeting multiple user IDs within a short time window.
Album deletion or mass asset removal events performed by a user account that was recently promoted from editor to owner.

Detection Strategies

Review immich application logs for PUT /albums/*/user/* requests where the requester is not the current album owner.
Audit the album_users table for role transitions on owner records, particularly demotions from owner to editor.
Correlate role change events with subsequent destructive actions such as album deletion or member removal.

Monitoring Recommendations

Enable request-level logging on the immich reverse proxy to capture all requests to /albums/:id/user/:userId endpoints.
Establish alerts for any role change event affecting a user whose record predates all other members in an album.
Track failed authorization responses after upgrading to 3.0.3 to identify attackers probing the patched endpoint.

How to Mitigate CVE-2026-59258

Immediate Actions Required

Upgrade all immich server deployments to version 3.0.3 or later.
Audit existing shared albums for unexpected ownership changes and restore original owners where takeover is suspected.
Review the list of editors on sensitive shared albums and remove any accounts that are not strictly required.

Patch Information

The fix is included in immich release v3.0.3, delivered via pull request #29883 and commit 84dff19ca9a467752d848ff54763d62c04ebf960. The patch adds an owner-check in AlbumService.updateUser that throws BadRequestException('User is owner') when the target userId matches the album owner. See the immich v3.0.3 release notes and the VulnCheck advisory for full details.

Workarounds

Restrict shared album access to viewer-only roles until the upgrade to 3.0.3 is complete.
Block the PUT /albums/:id/user/:userId endpoint at the reverse proxy layer for non-administrative users if patching is delayed.
Limit exposure of the immich instance to trusted networks or authenticated VPN users to reduce attack surface.

bash

# Upgrade immich using Docker Compose
cd /path/to/immich
sed -i 's/IMMICH_VERSION=.*/IMMICH_VERSION=v3.0.3/' .env
docker compose pull
docker compose up -d

# Verify running version
docker compose exec immich-server cat /usr/src/app/server/package.json | grep version