CVE-2026-104867 | immich-app Immich up to 3.1.x Calendar Heatmap user-admin.service.ts UserAdminService.getCalendarHeatmap privileges management

A vulnerability described as problematic has been identified in immich-app Immich up to 3.1.x. The impacted element is the function UserAdminService.getCalendarHeatmap of the file server/src/services/user-admin.service.ts of the component Calendar Heatmap. Executing a manipulation can lead to improper privilege management.

This vulnerability appears as CVE-2026-104867. The attack may be performed from remote. There is no available exploit.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More