Immich
Immich
Self-hosted photo and video management platform.
Current version
3.0.3
- Release date
- July 15, 2026
- Security status
- 2 high-severity CVEs tracked in the last 90 days. Current version impact is unclear.
Source
GitHub API
Public release notes are linked for the latest stored release.
Release history
See the latest published releases stored for this product.
| Version | Published | Notes |
|---|---|---|
| 3.0.3 | 2026-07-15 | Release Notes |
| 3.0.2 | 2026-07-09 | Release Notes |
| 3.0.1 | 2026-07-02 | Release Notes |
| 2.7.5 | 2026-04-13 | Release Notes |
| 2.7.4 | 2026-04-10 | Release Notes |
| 2.7.3 | 2026-04-09 | Release Notes |
| 2.7.2 | 2026-04-07 | Release Notes |
| 2.6.3 | 2026-03-26 | Release Notes |
| 2.6.2 | 2026-03-24 | Release Notes |
| 2.6.1 | 2026-03-19 | Release Notes |
| v2.5.6 | 2026-02-10 | Release Notes |
Vulnerability tracking
versionPing monitors CVEs for this product. Matching CVEs are listed below. We only display CVEs with a CVSS score of 7.0 or higher that were published within the last 90 days.
Affected status is inferred from published affected version ranges where available. Always verify against the vendor advisory before making production decisions.
| CVE | Severity | Published | Status | Summary |
|---|---|---|---|---|
| CVE-2026-59258 | HIGH (8.3) | 2026-07-15 | Current versionunclear | immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can demote the album owner to editor and promote themselves to owner in sequential requests, gaining full control including deletion and eviction capabilities. |
| CVE-2026-53662 | CRITICAL (9.6) | 2026-06-23 | Current versionunclear | immich is a high performance self-hosted photo and video management solution. From commit 4ffa26c9 until 4eb1003, a reflected cross-site scripting (XSS) vulnerability on the /auth/login page allows an attacker to fully compromise any authenticated user's account with a single link click. The continue query parameter is read from the URL and passed to SvelteKit's redirect() without any scheme or origin validation, allowing attacker-controlled JavaScript to execute inside Immich's origin. The payload then uses the victim's existing session to mint an all-permission API key on their account, leading to persistent account takeover. This vulnerability is fixed in commit 4eb1003. |