CVE-2026-23896

CVE-2026-23896 describes a high-severity privilege escalation vulnerability in Immich, a self-hosted photo and video management solution, affecting versions prior to 2.5.0. A low-privilege API key can exploit this flaw by calling the update endpoint to grant itself full administrative access to the system. With a CVSS score of 7.2 (High), this vulnerability allows an attacker with high privileges (PR:H) to achieve complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) with low attack complexity (AC:L). There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.