What’s Vulnerable › Products

immich-app immich vulnerabilities

11 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Check whether your immich-app immich version is affected

Latest immich-app immich vulnerabilities

• CVE-2026-108165 — Immich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadata (CVSS 4.3)
• CVE-2026-105764 — Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE (CVSS 7.7)
• CVE-2026-103532 — immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization (CVSS 5.3)
• CVE-2026-82272 — Immich Locked Assets Remain Readable Through Albums and Shared Links (CVSS 6.5)
• CVE-2026-59258 — immich < 3.0.3 Shared Album Editor Ownership Takeover via updateUser (CVSS 8.3)
• CVE-2026-53662 — immich: One-click account takeover via XSS in login page continue redirect (CVSS 9.6)
• CVE-2026-40096 — immich: Open Redirect via Shared Album name (CVSS 5.4)
• CVE-2026-35455 — immich has Stored XSS via OCR Text in 360° Panorama Viewer (CVSS 5.4)
• CVE-2026-25118 — immich-server: Insecure Transmission of Authentication Credentials via Password Parameter in HTTP Request Query String When Accessing Shared Albums (CVSS 7.5)
• CVE-2026-23896 — immich API Key Privilege Escalation vulnerability (CVSS 8.8)
• CVE-2025-43856 — immich allows account hijacking through oauth2 (CVSS 7.3)