Is CVE-2026-77439 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77439 being exploited in the wild.

How severe is CVE-2026-77439?

High severity, with a CVSS score of 8.8, published 5 November 2026.

Is there a fix for CVE-2026-77439?

Yes: fixed in 3.0.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77439 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-77439?

Check whether you run Immich at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77439: Immich unauthorized album owner role modification

CVE-2026-77439 · Severity: high · CVSS 8.8 · Published 2026-11-05

Immich is a self-hosted photo and video management solution. An authenticated user with editor access to a shared album can demote the album owner and promote themselves to take ownership, potentially delete the album, and remove the original owner from it. This allows a trusted editor to escalate privileges and take complete control of shared photo libraries.

Technologies: Immich. Vendors: Immich.

Quick answers

Is CVE-2026-77439 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77439 being exploited in the wild.
How severe is CVE-2026-77439?: High severity, with a CVSS score of 8.8, published 5 November 2026.
Which products and versions are affected?: Immich prior to 3.0.3.
Is there a fix for CVE-2026-77439?: Yes: fixed in 3.0.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77439 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-77439?: Check whether you run Immich at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.0.3

Technical details

An authorization flaw in album member role update operations allows an editor-role user to modify the owner's role without proper access controls. By demoting the owner to a lower role and promoting themselves, an attacker gains full ownership. The vulnerability requires prior authentication and editor-level access to the shared album; it is fixed in version 3.0.3.

Affected products

Immich Immich prior to 3.0.3

Timeline

2026-11-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.