Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
immich-app/immich
main @ 0931a19
83
Fixes
4
CVEs
HIGH
Peak severity
47.2%
Coverage
Highlights
Auth Bypass: 47 prior fixes. Scrutinize any change in this area.
server: most-fixed (10 issues). Treat as high-risk during review.
42 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Critical endpoints like token validation, API key generation, and administrative signup lacked strict permission scopes, allowing lower-privileged users or keys to bypass access gates or escalate privileges.
Path Traversal: Insufficient sanitization of user-supplied storage labels, zip file entries, and import directory paths allowed attackers to traverse root directory boundaries and access arbitrary files on the system host.
Broken Access Control: Query definitions and search indexing APIs failed to strictly enforce owner boundaries, leaking recognized people data and locked assets to unauthorized partner accounts.