CVE-2026-119329

MEDIUM 4.3

Immich: Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers used server/src/services/map.service.ts to add partner owner identifiers when withPartners=true, while server/src/repositories/map.repository.ts applied Archive visibility to every selected owner when isArchived=true. A view-only partner could therefore enumerate the GPS coordinates and existence of a sharer's archived photos or videos even though the timeline and direct-access paths exclude archived partner assets. The exposure is limited to location metadata and asset identifiers because image bytes remain protected by checkPartnerAccess. This issue is fixed in version 3.0.0.

CWE	CWE-639
Vendor	immich-app
Product	immich
Published	Oct 30, 2026

Stay Ahead of the Next One

Get instant alerts for immich-app immich

Be the first to know when new medium vulnerabilities affecting immich-app immich are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

immich-app / immich

< 3.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/immich-app/immich/security/advisories/GHSA-hv27-723h-qfjq github.com: https://github.com/immich-app/immich/pull/29028 github.com: https://github.com/immich-app/immich/commit/b633cc4f046f198bc11648c486e1e6e3f19d26d5 github.com: https://github.com/immich-app/immich/releases/tag/v3.0.0