CVE-2026-108165— Immich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadata
Quick assessment
Affected
immich-app immich
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Immich 3.3.1 及之前版本中存在一个授权缺失漏洞，位于配对同步流（partner synchronization stream）中。该漏洞允许已认证的配对用户访问“锁定文件夹”中资产的元数据，因为同步查询未排除锁定可见性。拥有活跃配对关系的攻击者可以调用 接口，并指定 和 类型，从而获取 GPS 坐标、拍摄时间、描述信息以及相机详细数据。
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local SystemAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| immich-app | immich | ≤ 3.3.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108165
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Immich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadata
Source: CVE Program / CVE List V5
Vulnerability Description
Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST /api/sync/stream with PartnerAssetsV2 and PartnerAssetExifsV1 types to obtain GPS coordinates, capture times, descriptions and camera details.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| immich-app | immich | 0 ~ 3.3.1 | - |
|
II. Public POCs for CVE-2026-108165
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108165
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-108165 (1)
Proof of Concept for CVE-2026-108165 (1)
Security Blog Posts for CVE-2026-108165 (1)
-
🔗 Immich partner sync returns metadata and EXIF for Locked Folder assets - HackMD Read full article exploit technical-description
IV. Related Vulnerabilities
Same product: immich
-
CVE-2026-105764
Immich: Authenticated SVG upload reaches ImageMagick coders -
CVE-2026-103532
immich-app Immich Shared Link Preview access.ts checkSharedL -
CVE-2026-82272
Immich Locked Assets Remain Readable Through Albums and Shar -
CVE-2026-59258
immich < 3.0.3 Shared Album Editor Ownership Takeover via up -
CVE-2026-53662
immich: One-click account takeover via XSS in login page con
Same vendor: immich-app
-
CVE-2026-105764
Immich: Authenticated SVG upload reaches ImageMagick coders -
CVE-2026-103532
immich-app Immich Shared Link Preview access.ts checkSharedL -
CVE-2026-82272
Immich Locked Assets Remain Readable Through Albums and Shar -
CVE-2026-59258
immich < 3.0.3 Shared Album Editor Ownership Takeover via up -
CVE-2026-53662
immich: One-click account takeover via XSS in login page con
Same weakness: CWE-862
-
CVE-2026-108708
Wukong_HRM through commit 186115e Missing Authorization via -
CVE-2026-108706
eladmin through commit 55fbf70 Missing Authorization via S3 -
CVE-2026-108705
CordysCRM through 1.9.3 Missing Authorization via /custom-fo -
CVE-2026-108703
CordysCRM through 1.9.3 Missing Authorization via /approval- -
CVE-2026-108702
CordysCRM through 1.9.3 Missing Authorization and Blind SSRF
V. Comments for CVE-2026-108165
No comments yet