CVE-2026-23896

immich is a high performance self-hosted photo and video management solution. Prior to version 2.5.0, API keys can escalate their own permissions by calling the update endpoint, allowing a low-privilege API key to grant itself full administrative access to the system. Version 2.5.0 fixes the issue.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/immich-app/immich/security/advisories/GHSA-237r-x578-h5mv	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:futo:immich:*:*:*:*:*:docker:*:*

History

15 Apr 2026, 18:55

Type	Values Removed	Values Added
First Time		Futo immich Futo
CPE	cpe:2.3:a:immich:immich::::::docker::*	cpe:2.3:a:futo:immich::::::docker::*

10 Mar 2026, 18:00

Type	Values Removed	Values Added
CWE		NVD-CWE-noinfo
Summary		(es) immich es una solución de gestión de fotos y videos autoalojada de alto rendimiento. Antes de la versión 2.5.0, las claves API pueden escalar sus propios permisos al llamar al endpoint de actualización, permitiendo que una clave API de bajo privilegio se otorgue acceso administrativo completo al sistema. La versión 2.5.0 corrige el problema.
References	~~() https://github.com/immich-app/immich/security/advisories/GHSA-237r-x578-h5mv -~~	() https://github.com/immich-app/immich/security/advisories/GHSA-237r-x578-h5mv - Exploit, Vendor Advisory
CPE		cpe:2.3:a:immich:immich::::::docker::*
First Time		Immich Immich immich

29 Jan 2026, 18:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-29 18:16

Updated : 2026-04-15 18:55

NVD link : CVE-2026-23896

Mitre link : CVE-2026-23896

CVE.ORG link : CVE-2026-23896

JSON object : View

Products Affected

futo

immich

CWE

CWE-269

Improper Privilege Management

NVD-CWE-noinfo

{"id": "CVE-2026-23896", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2026-01-29T18:16:14.970", "references": [{"url": "https://github.com/immich-app/immich/security/advisories/GHSA-237r-x578-h5mv", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-269"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "immich is a high performance self-hosted photo and video management solution. Prior to version 2.5.0, API keys can escalate their own permissions by calling the update endpoint, allowing a low-privilege API key to grant itself full administrative access to the system. Version 2.5.0 fixes the issue."}, {"lang": "es", "value": "immich es una soluci\u00f3n de gesti\u00f3n de fotos y videos autoalojada de alto rendimiento. Antes de la versi\u00f3n 2.5.0, las claves API pueden escalar sus propios permisos al llamar al endpoint de actualizaci\u00f3n, permitiendo que una clave API de bajo privilegio se otorgue acceso administrativo completo al sistema. La versi\u00f3n 2.5.0 corrige el problema."}], "lastModified": "2026-04-15T18:55:12.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:futo:immich:*:*:*:*:*:docker:*:*", "vulnerable": true, "matchCriteriaId": "6A876FF0-015E-48C7-8319-4E23ACC5F6F2", "versionEndExcluding": "2.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}