{"id":"CVE-2026-108165","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-108165","generatedAt":"2026-10-28T00:54:02.732Z","title":"Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility.","description":"Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST /api/sync/stream with PartnerAssetsV2 and PartnerAssetExifsV1 types to obtain GPS coordinates, capture times, descriptions and camera details.","published":"2026-10-10T14:16:38.000Z","lastModified":"2026-10-18T12:16:57.000Z","status":"Deferred","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":5.3,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-862"],"affected":[],"epss":{"score":0.00199,"percentile":0.09662,"date":"2026-10-26","history":[{"date":"2026-10-11","score":0.00199,"percentile":0.08994}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.20%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-10T14:16:38.000Z","detail":{"score":"5.3","severity":"MEDIUM","publishedAt":"2026-10-10T14:16:37.800Z"},"summary":"New CVE, medium severity (CVSS 5.3)."}],"references":[{"url":"https://github.com/immich-app/immich","source":"disclosure@vulncheck.com"},{"url":"https://github.com/immich-app/immich/blob/db6e11ecc851228aec9c525abb0ee026d1f5055e/server/src/repositories/access.repository.ts#L207-L228","source":"disclosure@vulncheck.com"},{"url":"https://github.com/immich-app/immich/blob/db6e11ecc851228aec9c525abb0ee026d1f5055e/server/src/repositories/sync.repository.ts#L662-L722","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@haind/immich-partner-sync-locked-metadata","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/immich-through-3.3.1-missing-authorization-in-partner-sync-exposes-locked-folder-metadata","source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-108165","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}