Vulnerability · Published Oct 10, 2026 · Assigned by VulnCheck

CVE-2026-108165Immich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadata

Medium 4.3

In plain English

A medium-severity missing authorization in immich from immich-app. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 90.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST /api/sync/stream with PartnerAssetsV2 and PartnerAssetExifsV1 types to obtain GPS coordinates, capture times, descriptions and camera details.

Affected products (as reported)

Vendor	Product	Versions
immich-app	immich	0 – through 3.3.1

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://hackmd.io/@haind/immich-partner-sync-locked-metadata exploit, technical-description
https://github.com/immich-app/immich/blob/db6e11ecc851228aec9c525abb0ee026d1f5055e/server/src/repositories/sync.repository.ts#L662-L722 technical-description
https://github.com/immich-app/immich/blob/db6e11ecc851228aec9c525abb0ee026d1f5055e/server/src/repositories/access.repository.ts#L207-L228 technical-description
https://github.com/immich-app/immich product
VulnCheck Advisory: Immich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadata third-party-advisory