CVE-2026-59258 describes an incorrect authorization vulnerability in immich before version 3.0.3. The vulnerability exists in the PUT /albums/:id/user/:userId API endpoint, where shared album editors can change member roles without owner-only restrictions. This allows an attacker with editor access to demote the legitimate album owner to editor and promote themselves to owner by making sequential requests. As a result, the attacker gains full control over the album, including the ability to delete content and evict members.

An attacker with editor privileges on a shared album can escalate their permissions to owner by exploiting the broken access control. This leads to full administrative control over the album, enabling deletion of content and eviction of other members, including the original owner. The vulnerability thus compromises the integrity and availability of album data and membership.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict editor permissions carefully and monitor for suspicious role changes. Avoid granting editor access to untrusted users. Follow vendor updates for a patch or official remediation.