CyberRota Analysis
AI-GeneratedThe vulnerability allows users with editor access to shared albums to manipulate member roles, enabling them to demote the album owner and elevate their own privileges to owner status. This can lead to unauthorized control over the album, including the ability to delete or evict members. Organizations using immich versions prior to 3.0.3 should prioritize patching this issue to prevent potential abuse of album permissions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can demote the album owner to editor and promote themselves to owner in sequential requests, gaining full control including deletion and eviction capabilities.