Get real-time updates on Telegram
CVE-2026-59258: immich 0 to before 3.0.3
CVE-2026-59258. CVSS 3.1 base score 8.3 (HIGH, Vendor/CNA). EPSS 0.00456 (percentile 0.38652), scored 24-Oct-2026.
Affected technology
immich · 0 to before 3.0.3
immich-app
Description’s affected range: before 3.0.3
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required
What an attacker can do
Attackers with editor access can demote the album owner to editor and promote themselves to owner in sequential requests, gaining full control including deletion and eviction capabilities. Vendor/CNA’s CVSS 4.0 assessment (base score 7.2/10) rates confidentiality impact as low; integrity and availability impact as high.
- CWE
- CWE-863
- CCR priority
- 33.3 /100 (P4)
- CVSS 3.1
- 8.3 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H · Vendor/CNA
- EPSS
- 0.00456 · percentile 0.38652 · 2026-10-24
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-25 01:28:19.133527+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-59258.html