CVE-2026-104867— Immich calendar heatmap endpoint discloses cross-user activity through broken access control

Quick assessment

Affected

immich-app immich

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Immich 是一款高性能的自托管照片与视频管理解决方案。在 3.0.0 至 3.2.0 版本期间，中的路由仅使用了普通的权限，而未强制要求管理员路由权限；同时，中的方法也未对已认证用户与请求中的用户标识符进行比对，或执行独立的访问控制检查。因此，任何已认证的非管理员用户均可请求任意日期范围内其他账户的上传或拍摄活动热力图。此外，中的方法虽按所有者、日期和删除状态进行过滤，但未考虑可见性（visibility），导致返回的每日计数和总计数包含了已归档和已锁定的资产。该路由仅暴露计数和活动时间，不返回资

CVSS 4.3 · Medium Updated Nov 06, 2026

Possible ATT&CK Techniques 1 AI

T1040 · Network Sniffing

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Immich calendar heatmap endpoint discloses cross-user activity through broken access control

Source: CVE Program / CVE List V5

Vulnerability Description

Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/{id}/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission without an admin-route requirement, and UserAdminService.getCalendarHeatmap in server/src/services/user-admin.service.ts does not compare the authenticated user with the requested user identifier or perform a separate access check. Any authenticated non-admin user can therefore request another account's upload or capture-date activity heatmap for an arbitrary date range. AssetRepository.getCalendarHeatmap in server/src/repositories/asset.repository.ts filters by owner, date, and deletion state but not visibility, so the returned daily counts and total count include archived and locked assets. The route exposes counts and activity dates but does not return asset metadata or content, and it does not affect integrity or availability. This issue is fixed in version 3.2.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

访问控制不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
immich-app	immich	>= 3.0.0, < 3.2.0	-

II. Public POCs for CVE-2026-104867

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-104867

请登录查看更多情报信息。

Other References for CVE-2026-104867 (4)

https://github.com/immich-app/immich/pull/30310 x_refsource_MISC
https://github.com/immich-app/immich/security/advisories/GHSA-g82p-27g4-864h x_refsource_CONFIRM
https://github.com/immich-app/immich/commit/f68815e35f4677dbc3a8ff58a7402952672dfceb x_refsource_MISC
https://github.com/immich-app/immich/commit/6c86d39f6d9955fc5e2998ce808e6f794b5ebd5e x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-104867

IV. Related Vulnerabilities

Same product: immich

Same vendor: immich-app

Same weakness: CWE-284