Immich album editors can take ownership of shared albums
An album editor on your photo server can push out the owner and take the album.
Summary
An authenticated user with editor access to a shared album can change the owner's role and take over the album, removing the original owner. Versions before 3.0.3 are affected.
Affected when
- Authenticated user with editor access to a shared album
- Immich before 3.0.3
What to do
Update Immich to 3.0.3 or later.
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen