CVE-2026-119329

Name of the Vulnerable Software and Affected Versions Immich versions prior to 3.0.0

Description An issue exists where a view-only partner can enumerate the existence and GPS coordinates of a sharer's archived photos or videos. This occurs because the endpoint "/api/map/markers" uses server/src/services/map.service.ts to add partner owner identifiers when withPartners is set to true, while server/src/repositories/map.repository.ts applies archive visibility to every selected owner when isArchived is true. Although the timeline and direct-access paths exclude archived partner assets, this flaw allows the exposure of location metadata and asset identifiers. Image bytes remain protected by the checkPartnerAccess() function.

Recommendations Update to version 3.0.0.