# CVE-2026-59258: Immich broken access control in shared album user management

Source: https://junglewise.ai/threats/cve-2026-59258-immich-broken-access-control-in-shared-album-user-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-59258 · Severity: high · CVSS 8.3 · Published 2026-07-15

Immich, a self-hosted photo and video management solution, contains a security flaw in how it handles shared album permissions. An authorized user who has been granted 'Editor' access to a shared album can exploit this bug to demote the original owner and take full control of the album. This allows the attacker to delete the album, evict the rightful owner, or modify all content within it.

Technologies: [Immich](https://junglewise.ai/threats/technologies/immich). Vendors: [Immich](https://junglewise.ai/threats/vendors/immich).

## Quick answers

**Is CVE-2026-59258 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59258 being exploited in the wild.

**How severe is CVE-2026-59258?** High severity, with a CVSS score of 8.3, published 15 July 2026.

**Which products and versions are affected?** Immich < 3.0.3.

**Is there a fix for CVE-2026-59258?** A patch was published on 2026-07-13: Fix merged into main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59258 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-59258?** Check whether you run Immich at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A broken access control vulnerability exists in the `PUT /albums/:id/user/:userId` endpoint in Immich. The application incorrectly authorizes this endpoint using the `Permission.AlbumShare` gate, which is granted to both owners and users with the 'Editor' role. Because the backend fails to verify if the requester is the actual owner or if the target of the update is the owner, an attacker with Editor permissions can demote the current owner to an Editor and then promote themselves to the 'Owner' role. This grants the attacker full administrative rights over the album, including deletion and member eviction. The issue is fixed in version 3.0.3.

## Affected products

- immich-app immich < 3.0.3

## Timeline

- 2026-06-09: disclosed: Initial report to developers via email
- 2026-07-13: patched: Fix merged into main branch
- 2026-07-15: advisory: CVE published and version 3.0.3 released

## References

- [https://github.com/immich-app/immich/commit/84dff19ca9a467752d848ff54763d62c04ebf960](https://github.com/immich-app/immich/commit/84dff19ca9a467752d848ff54763d62c04ebf960)
- [https://github.com/immich-app/immich/issues/29857](https://github.com/immich-app/immich/issues/29857)
- [https://github.com/immich-app/immich/pull/29883](https://github.com/immich-app/immich/pull/29883)
- [https://github.com/immich-app/immich/releases/tag/v3.0.3](https://github.com/immich-app/immich/releases/tag/v3.0.3)
- [https://www.vulncheck.com/advisories/immich-shared-album-editor-ownership-takeover-via-updateuser](https://www.vulncheck.com/advisories/immich-shared-album-editor-ownership-takeover-via-updateuser)

## Related threats

- [Immich unauthorized album owner role modification](https://junglewise.ai/threats/cve-2026-77439-immich-is-a-self-hosted-photo-and-video-management-solution-prior)
- [Immich calendar heatmap unauthorized access vulnerability](https://junglewise.ai/threats/cve-2026-104867-immich-is-a-high-performance-self-hosted-photo-and-video)
- [Immich information disclosure in map markers API](https://junglewise.ai/threats/cve-2026-119329-immich-is-a-high-performance-self-hosted-photo-and-video)
- [Immich missing authorization in partner sync stream](https://junglewise.ai/threats/cve-2026-108165-immich-through-3-3-1-contains-a-missing-authorization)
- [Immich SVG upload to ImageMagick remote code execution](https://junglewise.ai/threats/cve-2026-105764-immich-is-a-high-performance-self-hosted-photo-and-video)