CVE-2026-108165 Details

A missing authorization vulnerability has been identified in Immich versions through 3.3.1. This vulnerability exists in the partner synchronization stream, allowing authenticated partners to access metadata of assets stored in Locked Folders. The issue arises because the synchronization queries do not filter out assets marked as Locked. Partners can exploit this by sending a POST request to the /api/sync/stream endpoint, requesting PartnerAssetsV2 and PartnerAssetExifsV1 types. This request can retrieve sensitive EXIF data, including GPS coordinates, capture times, descriptions, and camera details, for locked assets.

The vulnerability can be addressed by modifying the synchronization queries to include a visibility filter that excludes locked assets. This adjustment should be applied to both the asset and EXIF synchronization paths, ensuring that partners cannot access locked metadata. Additionally, implementing a regression test to verify that locked assets are not emitted during synchronization can help prevent future occurrences of this issue.