Auth bypass in Immich-App Immich
CVE-2026-108165
Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST /api/sync/stream with PartnerAssetsV2 and PartnerAssetExifsV1 types to obtain GPS coordinates, capture times, descriptions and camera details.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- hackmd.io/@haind/immich-partner-sync-locked-metadata (technical-description, exploit)
- github.com/immich-app/immich/blob/db6e11ecc851228aec9c525abb0ee026d1f5055e/serv… (technical-description)
- github.com/immich-app/immich/blob/db6e11ecc851228aec9c525abb0ee026d1f5055e/serv… (technical-description)
- github.com/immich-app/immich (product)
- www.vulncheck.com/advisories/immich-through-3.3.1-missing-authorization-in-part… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-108165?
- CVE-2026-108165 is a medium-severity vulnerability in Immich-App Immich, classified under Missing Authorization. CVSS score: 4.3/10. Published 2026-10-10.
- How severe is CVE-2026-108165?
- Medium severity. CVSS v3 base score is 4.3 out of 10.