CVE-2026-77439

Summary

An authenticated user with editor privileges in a shared album can escalate to owner by demoting the current owner and promoting themselves, bypassing role-based access controls due to missing protection on the owner role during member updates.

Exploitability

Requires valid authentication and existing editor-level access to a shared album; low effort for an attacker meeting these conditions.

Blast radius

An attacker could fully compromise the album by removing the original owner, deleting all content, and gaining full control over the album's data and sharing settings.

Detection

Monitor for unusual role changes in shared albums—specifically, events where an editor user demotes the owner and promotes themselves; look for consecutive 'album_member_role_updated' log entries with a role change from 'owner' to 'editor' followed by 'editor' to 'owner' by the same user.

Prioritized remediation

Upgrade to Immich version 3.0.3 or later, which patches the missing protection on the owner role during album member role updates.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.