Immich versions 3.0.0 through 3.2.0 contain a broken access control flaw in the GET /api/admin/users/{id}/calendar‑heatmap endpoint. The handler requires only the ordinary UserRead permission and does not verify that the requesting user is an administrator or the owner of the requested calendar data. Because the returned data consists only of aggregate counts and dates, an attacker can use an authenticated non‑admin account to discover another user’s upload or capture‑date activity for arbitrary date ranges without learning any asset metadata or content. The vulnerability therefore provides a confidentiality breach that reveals activity patterns across user accounts.

The affected product is the Immich photo and video management application provided by the immich-app:immich vendor. Any installation running a version from 3.0.0 up to (but not including) 3.2.0 is susceptible. The issue is fixed in release 3.2.0 and later, where the route is protected by an administrative privilege check and the service verifies the ownership of the requested data.

The CVSS score of 4.3 indicates low overall severity, and the vulnerability does not compromise integrity or availability. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, suggesting that automated exploitation is not currently tracked. The likely attack path involves a legitimate, authenticated user who is not an administrator sending a crafted request to the /api/admin/users/{id}/calendar‑heatmap endpoint with the target user’s identifier. No additional privilege escalation or exploit chain is required, so the risk is limited to privacy leakage of user activity.