CVE-2026-108165
Immich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadata
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST /api/sync/stream with PartnerAssetsV2 and PartnerAssetExifsV1 types to obtain GPS coordinates, capture times, descriptions and camera details.
| CWE | CWE-862 |
| Vendor | immich-app |
| Product | immich |
| Published | Oct 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for immich-app immich
Be the first to know when new medium vulnerabilities affecting immich-app immich are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
immich-app / immich
0 ≤ 3.3.1
References
hackmd.io: https://hackmd.io/@haind/immich-partner-sync-locked-metadata github.com: https://github.com/immich-app/immich/blob/db6e11ecc851228aec9c525abb0ee026d1f5055e/server/src/repositories/sync.repository.ts#L662-L722 github.com: https://github.com/immich-app/immich/blob/db6e11ecc851228aec9c525abb0ee026d1f5055e/server/src/repositories/access.repository.ts#L207-L228 github.com: https://github.com/immich-app/immich vulncheck.com: https://www.vulncheck.com/advisories/immich-through-3.3.1-missing-authorization-in-partner-sync-exposes-locked-folder-metadata
Credits
HaiND from the Post and Telecommunication Institute of Technology