CVE-2026-104867

Name of the Vulnerable Software and Affected Versions Immich versions 3.0.0 through 3.1.x

Description An issue exists where the GET '/api/admin/users/{id}/calendar-heatmap' endpoint uses the Permission.UserRead permission without requiring administrative privileges. Additionally, the getCalendarHeatmap() function in the UserAdminService fails to verify if the authenticated user matches the requested user identifier id or perform an access check. This allows any authenticated non-admin user to retrieve the upload or capture-date activity heatmap of another account for an arbitrary date range. The getCalendarHeatmap() function in AssetRepository filters by owner, date, and deletion state but ignores visibility, meaning the results include archived and locked assets. The endpoint exposes activity dates and counts but does not reveal asset metadata or content.

Recommendations Update to version 3.2.0.