점검 대응높음KEV 미등록
CVE-2026-59258
immich-app immich 취약점
immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can demote the album owner to editor and promote themselves to owner in sequential requests, gaining full control including deletion and eviction capabilities.
- 대응 우선순위
- 점검
- CVSS
- 7.2
- EPSS
- - 백분위 -
- CISA KEV
- 미등록
- 조치 기한
- -
- 공개일
- 2026.07.16