{"schema_version":1,"title":"Immich-App vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 5 vulnerabilities in Immich-App: 0 in the last 7 days and 2 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-119328, was published on 30 October 2026. 1 vulnerability in the last four weeks, level on the four before (1).","url":"https://junglewise.ai/threats/vendors/immich-app","json_url":"https://junglewise.ai/threats/vendors/immich-app.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/immich-app","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","thin":true,"counts":{"high":3,"all_time":5,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":1,"last_90_days":2,"last_365_days":5},"latest":[{"cve":"CVE-2026-119328","cvss":6.5,"slug":"cve-2026-119328-immich-is-a-high-performance-self-hosted-photo-and-video","title":"Immich unauthenticated path traversal in ML endpoint","severity":"medium","exploited":false,"published_at":"2026-10-30T20:17:06.627+00:00","url":"https://junglewise.ai/threats/cve-2026-119328-immich-is-a-high-performance-self-hosted-photo-and-video"},{"cve":"CVE-2026-103532","cvss":5.3,"epss":0.0031,"slug":"cve-2026-103532-a-vulnerability-has-been-found-in-immich-app-immich-up-to-2-7-5","title":"Immich shared link password bypass in access control","severity":"medium","exploited":false,"published_at":"2026-10-01T02:16:53.6+00:00","url":"https://junglewise.ai/threats/cve-2026-103532-a-vulnerability-has-been-found-in-immich-app-immich-up-to-2-7-5"},{"cve":"CVE-2026-59258","cvss":8.3,"slug":"cve-2026-59258-immich-broken-access-control-in-shared-album-user-management","title":"Immich broken access control in shared album user management","severity":"high","exploited":false,"published_at":"2026-07-15T18:16:49.15+00:00","url":"https://junglewise.ai/threats/cve-2026-59258-immich-broken-access-control-in-shared-album-user-management"},{"cve":"CVE-2026-35455","cvss":7.3,"epss":0.0023,"slug":"cve-2026-35455-immich-stored-xss-in-360-degree-panorama-viewer","title":"Immich stored XSS in 360 degree panorama viewer","severity":"high","exploited":false,"published_at":"2026-04-08T19:25:24.357+00:00","url":"https://junglewise.ai/threats/cve-2026-35455-immich-stored-xss-in-360-degree-panorama-viewer"},{"cve":"CVE-2026-25118","cvss":7.5,"epss":0.0045,"slug":"cve-2026-25118-immich-credential-disclosure-in-shared-album-authentication","title":"Immich credential disclosure in shared album authentication","severity":"high","exploited":false,"published_at":"2026-04-03T16:16:36.023+00:00","url":"https://junglewise.ai/threats/cve-2026-25118-immich-credential-disclosure-in-shared-album-authentication"}],"vendor":{"hub":true,"name":"Immich-App","slug":"immich-app","description":"Self-hosted photo and video management platform.","url":"https://junglewise.ai/threats/vendors/immich-app"},"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-59258","cvss":8.3,"slug":"cve-2026-59258-immich-broken-access-control-in-shared-album-user-management","title":"Immich broken access control in shared album user management","severity":"high","exploited":false,"published_at":"2026-07-15T18:16:49.15+00:00","url":"https://junglewise.ai/threats/cve-2026-59258-immich-broken-access-control-in-shared-album-user-management"},{"cve":"CVE-2026-25118","cvss":7.5,"epss":0.0045,"slug":"cve-2026-25118-immich-credential-disclosure-in-shared-album-authentication","title":"Immich credential disclosure in shared album authentication","severity":"high","exploited":false,"published_at":"2026-04-03T16:16:36.023+00:00","url":"https://junglewise.ai/threats/cve-2026-25118-immich-credential-disclosure-in-shared-album-authentication"},{"cve":"CVE-2026-35455","cvss":7.3,"epss":0.0023,"slug":"cve-2026-35455-immich-stored-xss-in-360-degree-panorama-viewer","title":"Immich stored XSS in 360 degree panorama viewer","severity":"high","exploited":false,"published_at":"2026-04-08T19:25:24.357+00:00","url":"https://junglewise.ai/threats/cve-2026-35455-immich-stored-xss-in-360-degree-panorama-viewer"},{"cve":"CVE-2026-119328","cvss":6.5,"slug":"cve-2026-119328-immich-is-a-high-performance-self-hosted-photo-and-video","title":"Immich unauthenticated path traversal in ML endpoint","severity":"medium","exploited":false,"published_at":"2026-10-30T20:17:06.627+00:00","url":"https://junglewise.ai/threats/cve-2026-119328-immich-is-a-high-performance-self-hosted-photo-and-video"},{"cve":"CVE-2026-103532","cvss":5.3,"epss":0.0031,"slug":"cve-2026-103532-a-vulnerability-has-been-found-in-immich-app-immich-up-to-2-7-5","title":"Immich shared link password bypass in access control","severity":"medium","exploited":false,"published_at":"2026-10-01T02:16:53.6+00:00","url":"https://junglewise.ai/threats/cve-2026-103532-a-vulnerability-has-been-found-in-immich-app-immich-up-to-2-7-5"}],"generated_at":"2026-11-09T03:07:00.176479+00:00","technologies":[]}