CVE-2026-108165CWE-862broken-access-control

CVE-2026-108165

Medium · published October 10, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
9.3
In the wild
Unconfirmed
What it is

Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST /api/sync/stream with PartnerAssetsV2 and PartnerAssetExifsV1 types to obtain GPS coordinates, capture times, descriptions and camera details.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00199 · 9.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-10-10T18:16Z
References (5)
https://github.com/immich-app/immich · [email protected]https://github.com/immich-app/immich/blob/db6e11ecc851228aec9c525abb0ee026d1f5055e/server/src/repositories/access.repository.ts#L207-L228 · [email protected]https://github.com/immich-app/immich/blob/db6e11ecc851228aec9c525abb0ee026d1f5055e/server/src/repositories/sync.repository.ts#L662-L722 · [email protected]https://hackmd.io/@haind/immich-partner-sync-locked-metadata · [email protected]https://www.vulncheck.com/advisories/immich-through-3.3.1-missing-authorization-in-partner-sync-exposes-locked-folder-metadata · [email protected]
EPSS history
Timeline
  • 12 OCT 03:26Z
    EPSS moved — → 0%
    epss
  • 10 OCT 13:55Z
    Immich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadata
    cvelistv5
  • 10 OCT 13:55Z
    Immich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadata
    cvelistv5