A critical privilege escalation vulnerability in the Immich photo and video management platform allows low-privilege API keys to gain full administrative control, posing a severe risk to system integrity.

This vulnerability involves improper privilege management (CWE-269), where an authenticated user with limited API access can manipulate the update endpoint to grant themselves administrative privileges. The attack vector is network-based and requires an existing authenticated session.

The ability for a low-privilege user to escalate to administrative status creates a total compromise scenario for the Immich instance. An attacker gaining these permissions could access, delete, or modify all stored media assets, potentially leading to significant data loss or unauthorized disclosure of sensitive personal content. With a CVSS score of 7.2, this high-severity flaw necessitates immediate attention to prevent unauthorized administrative takeover.

Immediate Action: Update the Immich installation to version 2.5.0 or later immediately to apply the required security fix.

Proactive Monitoring: Review application access logs for unusual API activity, specifically focusing on requests to the update endpoint originating from non-administrative user accounts.

Compensating Controls: Restrict access to the Immich API via network-level controls or a Web Application Firewall (WAF) to ensure that only trusted clients can interact with administrative endpoints until the patch is applied.

Public Exploit Available: Unknown

Given the high impact of this privilege escalation vulnerability, organizations should prioritize upgrading their Immich deployment to version 2.5.0. Failure to patch allows any compromised or malicious low-privilege API key to bypass access controls and assume full administrative authority over the system. Ensure all deployment environments are updated and verify that no unauthorized administrative accounts were created while the system was vulnerable.