Immich machine-learning endpoint flaw listed by EUVD with CVSS 6.5
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- immich-app
- Product
- immich
- First seen
Summary
The EU Vulnerability Database entry EUVD-2026-114375, updated October 30, 2026, describes an unauthenticated machine-learning /predict endpoint in Immich that accepts an options object and passes its values into model construction. The listing scores it 6.5 out of 10 under CVSS v3.1 and says the issue affects versions before 3.3.0.
If you use immich-app
Upgrade Immich to version 3.3.0 or later
Restrict network access to the machine-learning service
Review the EUVD entry for full details
Upgrade Immich to version 3.0.0 or later
Review whether map sharing with partners is enabled on your instance
Upgrade Immich to version 3.2.0 or later
What the sources say 3
· Mastodon: “Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource” Source
· Mastodon: “Prior to 3.0.0, GET /api/map/markers used server/src/services/map.service.ts to add partner owner identifiers when withPartners=true” Source
· Mastodon: “Prior to 3.3.0, the unauthenticated machine-learning /predict endpoint in machine-learning/immich_ml/main.py accepted an options object” Source