Cyber Posture

CVE-2026-23896

HighPublic PoC

Published: 29 January 2026

Published
29 January 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0005 14.2th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-23896 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Futo Immich. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 14.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068).
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-269

Policy addresses roles, responsibilities, and privilege management to prevent improper privilege assignments.

addresses: CWE-269

Access supervision ensures privileges are assigned and managed without improper escalation or retention.

addresses: CWE-269

Assigning group/role memberships and access authorizations (privileges) while reviewing accounts addresses improper privilege management.

addresses: CWE-269

Enforces proper privilege management by requiring all decisions through the verified reference monitor.

addresses: CWE-269

By mandating division of duties across roles, the control enforces proper privilege management and prevents a single entity from controlling an entire sensitive process.

addresses: CWE-269

Implements core proper privilege management by restricting to only required rights.

addresses: CWE-269

Policy requires training on privilege management and least privilege, making it harder to exploit improper privilege management weaknesses.

addresses: CWE-269

Training covers proper privilege management practices, making incorrect privilege assignments less likely.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Direct privilege escalation via API endpoint abuse matches Exploitation for Privilege Escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

immich is a high performance self-hosted photo and video management solution. Prior to version 2.5.0, API keys can escalate their own permissions by calling the update endpoint, allowing a low-privilege API key to grant itself full administrative access to the…

more

system. Version 2.5.0 fixes the issue.

Deeper analysisAI

CVE-2026-23896 is a privilege escalation vulnerability in Immich, a high-performance self-hosted photo and video management solution. In versions prior to 2.5.0, API keys can exploit an update endpoint to escalate their own permissions, enabling a low-privilege API key to grant itself full administrative access to the system. The issue is classified under CWE-269 (Improper Privilege Management) with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

An attacker with access to a low-privilege API key can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By calling the vulnerable update endpoint, the attacker escalates the API key's permissions to full administrative privileges, potentially allowing high-impact unauthorized access to confidentiality, integrity, and availability of the Immich system.

The official GitHub security advisory (GHSA-237r-x578-h5mv) confirms that upgrading to Immich version 2.5.0 resolves the vulnerability by addressing the improper permission escalation in the API key update mechanism. Security practitioners should prioritize patching affected deployments and review existing API key permissions.

Details

CWE(s)

Affected Products

futo
immich
≤ 2.5.0

CVEs Like This One

CVE-2026-25118Same product: Futo Immich
CVE-2026-35455Same product: Futo Immich
CVE-2026-2777Shared CWE-269
CVE-2025-48613Shared CWE-269
CVE-2026-35595Shared CWE-269
CVE-2025-64487Shared CWE-269
CVE-2025-67905Shared CWE-269
CVE-2024-13376Shared CWE-269
CVE-2025-26705Shared CWE-269
CVE-2025-37186Shared CWE-269

References