CVE-2026-23896 — immich API Key Privilege Escalation vulnerability

CVE-2026-23896

immich API Key Privilege Escalation vulnerability PUBLISHED

Description (CNA)

immich is a high performance self-hosted photo and video management solution. Prior to version 2.5.0, API keys can escalate their own permissions by calling the update endpoint, allowing a low-privilege API key to grant itself full administrative access to the system. Version 2.5.0 fixes the issue.

Affected (CNA)

Vendor / product	Versions
immich-app / immich	affected < 2.5.0

CWE

CWE-269

References

https://github.com/immich-app/immich/security/advisories/GHSA-237r-x578-h5mv

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.