# CVE-2026-77439: Immich unauthorized album owner role modification

Source: https://junglewise.ai/threats/cve-2026-77439-immich-is-a-self-hosted-photo-and-video-management-solution-prior  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-77439 · Severity: high · CVSS 8.8 · Published 2026-11-05

Immich is a self-hosted photo and video management solution. An authenticated user with editor access to a shared album can demote the album owner and promote themselves to take ownership, potentially delete the album, and remove the original owner from it. This allows a trusted editor to escalate privileges and take complete control of shared photo libraries.

Technologies: [Immich](https://junglewise.ai/threats/technologies/immich). Vendors: [Immich](https://junglewise.ai/threats/vendors/immich).

## Quick answers

**Is CVE-2026-77439 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77439 being exploited in the wild.

**How severe is CVE-2026-77439?** High severity, with a CVSS score of 8.8, published 5 November 2026.

**Which products and versions are affected?** Immich prior to 3.0.3.

**Is there a fix for CVE-2026-77439?** Yes: fixed in 3.0.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77439 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-77439?** Check whether you run Immich at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.0.3

## Technical details

An authorization flaw in album member role update operations allows an editor-role user to modify the owner's role without proper access controls. By demoting the owner to a lower role and promoting themselves, an attacker gains full ownership. The vulnerability requires prior authentication and editor-level access to the shared album; it is fixed in version 3.0.3.

## Affected products

- Immich Immich prior to 3.0.3

## Timeline

- 2026-11-05: disclosed

## References

- [https://github.com/immich-app/immich/commit/84dff19ca9a467752d848ff54763d62c04ebf960](https://github.com/immich-app/immich/commit/84dff19ca9a467752d848ff54763d62c04ebf960)
- [https://github.com/immich-app/immich/pull/29883](https://github.com/immich-app/immich/pull/29883)

## Related threats

- [Immich calendar heatmap unauthorized access vulnerability](https://junglewise.ai/threats/cve-2026-104867-immich-is-a-high-performance-self-hosted-photo-and-video)
- [Immich information disclosure in map markers API](https://junglewise.ai/threats/cve-2026-119329-immich-is-a-high-performance-self-hosted-photo-and-video)
- [Immich missing authorization in partner sync stream](https://junglewise.ai/threats/cve-2026-108165-immich-through-3-3-1-contains-a-missing-authorization)
- [Immich SVG upload to ImageMagick remote code execution](https://junglewise.ai/threats/cve-2026-105764-immich-is-a-high-performance-self-hosted-photo-and-video)
- [Immich locked asset visibility bypass in shared albums](https://junglewise.ai/threats/cve-2026-82272-immich-locked-asset-visibility-bypass-in-shared-albums)