CVE-2026-77439

Name of the Vulnerable Software and Affected Versions Immich versions prior to 3.0.3

Description An authenticated user with editor access to a shared album can modify the role of the album owner. Because role updates for album members do not protect the owner from modification, an editor can demote the owner and promote themselves to take ownership of the album, which allows them to remove the original owner and delete the album.

Recommendations Update to version 3.0.3.