Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
immich is a high performance self-hosted photo and video management solution. Prior to version 2.5.0, API keys can escalate their own permissions by calling the update endpoint, allowing a low-privilege API key to grant itself full administrative access to the system. Version 2.5.0 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-23896 Immich API Key Privilege Escalation Vulnerability Prior to Version 2.5.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-23896
Post summary
The CVE-2026-23896 represents an API key privilege escalation flaw in Immich versions before 2.5.0, as disclosed in a short vulnerability announcement.
CVE-2026-23896 immich is a high performance self-hosted photo and video management solution. Prior to version 2.5.0, API keys can escalate their own permissions by calling the updat… https://www.cve.org/CVERecord?id=CVE-2026-23896
Post summary
CVE-2026-23896 is a privilege‑escalation flaw in immich that allows API keys to gain higher permissions via the update endpoint; the issue is fixed in version 2.5.0.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | futo | immich | - | docker | - |