CVE-2026-108165

Name of the Vulnerable Software and Affected Versions Immich versions prior to 3.3.2

Description A missing authorization issue exists in the partner synchronization stream. Authenticated partners can access metadata for assets within the Locked Folder because synchronization queries fail to exclude assets with Locked visibility. An attacker with an active partner relationship can use the 'POST /api/sync/stream' endpoint with PartnerAssetsV2 and PartnerAssetExifsV1 types to retrieve sensitive information, including GPS coordinates, capture times, descriptions, and camera details.

Recommendations Update to version 3.3.2 or later.