An authenticated API key can use the update endpoint to increase its own permission level to full administrative rights. This privilege escalation lets an attacker read, modify, or delete all stored media and system settings, undermining confidentiality, integrity, and availability of the immich deployment.

The vulnerability affects the immich‑app photo and video management solution. Any installation running a version earlier than 2.5.0 is vulnerable, regardless of platform, including Docker deployments as indicated by the CPE record cpe:2.3:a:futo:immich:*:*:*:*:*:docker:*:*.

The CVSS score of 7.2 signals high severity, yet the EPSS score of less than 1% indicates a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an existing API key; once a key is obtained, the attacker can call the update endpoint to grant themselves administrator access, potentially compromising the entire system.