The vulnerability is a broken access control flaw in the PUT /albums/:id/user/:userId endpoint of immich, allowing any shared album editor to modify the roles of other members. An attacker with editor privileges can sequentially demote the rightful album owner to editor and promote themselves to owner, thus obtaining full control over the album including deletion and eviction capabilities. This issue is mapped to CWE-863, representing an authorization bypass that occurs through a user‑controlled key.

The flaw affects the immich application from the immich-app vendor, specifically all releases prior to version 3.0.3. Users running any immich instance before the 3.0.3 release are vulnerable.

The CVSS score of 7.2 indicates a high severity for this vulnerability. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild at present, and the vulnerability is not currently listed in the CISA KEV catalog. Nevertheless, because ownership takeover is possible through a valid editor session, attackers who gain editor access to a shared album can easily manipulate role assignments with successive requests. The attack vector is localized to the application layer and requires only an account with editor permissions on a shared album.