Broken Access Control in Immich Before 3.0.3

Executive Summary

This vulnerability is a broken access control flaw in the immich application before version 3.0.3. It exists in the PUT /albums/:id/user/:userId endpoint, where users with editor access to shared albums can modify member roles without proper owner-only restrictions. Attackers can exploit this by first demoting the album owner to an editor role and then promoting themselves to owner in sequential requests, gaining full control over the album including deletion and eviction capabilities.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Immich instance is running a version before 3.0.3. Use commands like 'docker ps' to inspect running containers and their versions. Verify the endpoint PUT /albums/:id/user/:userId allows unauthorized role changes by testing if editors can modify owner permissions.

Useful 0 Not Useful 0

Impact Analysis

If you use immich versions before 3.0.3 and share albums with others, an attacker with editor access could take over your albums. They could delete your albums, remove members, or add unauthorized users. This could lead to loss of data, privacy breaches, or unauthorized access to your shared content.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or deletion of sensitive data stored in shared albums, potentially violating data protection requirements under GDPR or HIPAA. Organizations using affected Immich versions may face compliance risks if user data is compromised due to this flaw.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Immich to version 3.0.3 or later. Restrict network access to the PUT /albums/:id/user/:userId endpoint if possible. Review shared albums for unauthorized ownership changes and revoke suspicious access.

Useful 0 Not Useful 0