No VulnCrest analysis published for this CVE yet. Below is the original CNA/NVD description, unmodified.
Description
Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/{id}/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission without an admin-route requirement, and UserAdminService.getCalendarHeatmap in server/src/services/user-admin.service.ts does not compare the authenticated user with the requested user identifier or perform a separate access check. Any authenticated non-admin user can therefore request another account's upload or capture-date activity heatmap for an arbitrary date range. AssetRepository.getCalendarHeatmap in server/src/repositories/asset.repository.ts filters by owner, date, and deletion state but not visibility, so the returned daily counts and total count include archived and locked assets. The route exposes counts and activity dates but does not return asset metadata or content, and it does not affect integrity or availability. This issue is fixed in version 3.2.0.
Exploits & detection
No public PoC or detection template found yet.
Timeline
- Published: 05 Nov 2026
- Last modified upstream: 05 Nov 2026
Sources & licenses
- CVE / CVSS / CWE
- NVD record ↗ (unmodified). This product uses the NVD API but is not endorsed or certified by the NVD. CVE® © The MITRE Corporation.
- Exploitation
- CISA KEV (CC0) · EPSS by FIRST.org
- References used for the analysis
- https://github.com/immich-app/immich/commit/6c86d39f6d9955fc5e2998ce808e6f794b5ebd5e
- https://github.com/immich-app/immich/commit/f68815e35f4677dbc3a8ff58a7402952672dfceb
- https://github.com/immich-app/immich/pull/30310
- https://github.com/immich-app/immich/releases/tag/v3.2.0
- https://github.com/immich-app/immich/security/advisories/GHSA-g82p-27g4-864h
- https://github.com/immich-app/immich/security/advisories/GHSA-g82p-27g4-864h
- Analysis, summary and remediation
- © VulnCrest