Summary
Immich allows an authenticated editor of a shared album to change the album owner's role because role updates do not protect the owner from modification. An editor may be able to take ownership, remove the original owner, and delete the album.
Immich allows an authenticated editor of a shared album to change the album owner's role because role updates do not protect the owner from modification. An editor may be able to take ownership, remove the original owner, and delete the album.
Affected context
The issue occurs in shared-album member role updates. It affects deployments where an authenticated user with editor access can modify the role of the album owner, allowing the editor to gain ownership and control over the album.
The issue occurs in shared-album member role updates. It affects deployments where an authenticated user with editor access can modify the role of the album owner, allowing the editor to gain ownership and control over the album.
Exploit preconditions
- Attack surface: Shared-album member role management
- Required access: An authenticated account with editor access to the affected album
- Trigger point: Updating member roles when the album owner is not protected from role changes
- Why exploitation is possible: The role-update logic does not enforce the owner's protected status, allowing an editor to alter ownership privileges
- Attack surface: Shared-album member role management
- Required access: An authenticated account with editor access to the affected album
- Trigger point: Updating member roles when the album owner is not protected from role changes
- Why exploitation is possible: The role-update logic does not enforce the owner's protected status, allowing an editor to alter ownership privileges
Why this happens
The underlying issue is an authorization and privilege-management failure. The role-update operation permits modification of a resource owner's privileges without enforcing an ownership invariant. This is associated with CWE-269: Improper Privilege Management; the resulting change in control over the album may also relate to CWE-639: Authorization Bypass Through User-Controlled Key.
The underlying issue is an authorization and privilege-management failure. The role-update operation permits modification of a resource owner's privileges without enforcing an ownership invariant. This is associated with CWE-269: Improper Privilege Management; the resulting change in control over the album may also relate to CWE-639: Authorization Bypass Through User-Controlled Key.
Potential impact
- An editor may take ownership of a shared album
- The original owner could be removed from the album
- The album could be deleted, causing loss of its shared content or access
- Album ownership and access controls could be altered without the owner's consent
- An editor may take ownership of a shared album
- The original owner could be removed from the album
- The album could be deleted, causing loss of its shared content or access
- Album ownership and access controls could be altered without the owner's consent
General mitigation guidance
Defensive patterns include enforcing server-side authorization for every role change and treating ownership as a protected state rather than an ordinary member role.
- Require explicit authorization checks before changing member roles
- Prevent role updates from demoting or replacing an owner unless an approved ownership-transfer process is used
- Derive the acting user's permissions from trusted server-side state, not client-provided identifiers or role claims
- Apply least privilege to album-management operations and log sensitive ownership changes
Defensive patterns include enforcing server-side authorization for every role change and treating ownership as a protected state rather than an ordinary member role.
- Require explicit authorization checks before changing member roles
- Prevent role updates from demoting or replacing an owner unless an approved ownership-transfer process is used
- Derive the acting user's permissions from trusted server-side state, not client-provided identifiers or role claims
- Apply least privilege to album-management operations and log sensitive ownership changes
How teams detect issues like this
Review role-update handlers for authorization checks that distinguish owners from other members and verify that client-controlled values cannot determine the actor's privileges.
- Use static analysis and code review to identify role changes that lack server-side ownership checks
- Test policy enforcement for attempts by editors to change owner roles or transfer ownership
- Monitor audit events for unexpected ownership changes, owner removal, or album deletion
- Enforce centralized authorization policies for sensitive album-management actions
Review role-update handlers for authorization checks that distinguish owners from other members and verify that client-controlled values cannot determine the actor's privileges.
- Use static analysis and code review to identify role changes that lack server-side ownership checks
- Test policy enforcement for attempts by editors to change owner roles or transfer ownership
- Monitor audit events for unexpected ownership changes, owner removal, or album deletion
- Enforce centralized authorization policies for sensitive album-management actions
