Immich: Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers
Immich v2.7.5 and earlier leak GPS coordinates of archived assets to partners with view-only sharing through the map markers API. CVSS rates it medium. Fixed in 3.0.0.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 3.0.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Immich, a self-hosted photo and video management application, is affected by a flaw in its map markers API that lets a partner with view-only access see the GPS locations and existence of another user's archived photos and videos. The exposed data is limited to location information and asset identifiers, not the actual image or video files.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers used server/src/services/map.service.ts to add partner owner identifiers when withPartners=true, while server/src/repositories/map.repository.ts applied Archive visibility to every selected owner when isArchived=true. A view-only partner could therefore enumerate the GPS coordinates and existence of a sharer's archived photos or videos even though the timeline and direct-access paths exclude archived partner assets. The exposure is limited to location metadata and asset identifiers because image bytes remain protected by checkPartnerAccess. This issue is fixed in version 3.0.0.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- immich-app immich
fixed in 3.0.0
References 4
GitHub · immich-app/immich
Questions about CVE-2026-119329
What does this mean?
Partners who have view-only access to a sharer's library can receive GPS coordinates of that sharer's archived assets through the map markers endpoint.Source: github.com
Am I affected, and how do I check?
The affected setup is an Immich server at v2.7.5 or earlier, with a request to GET /api/map/markers that sets withPartners=true and isArchived=true. Compare the running server version against this range.Source: github.com
What should I do about it?
Upgrade the Immich server to 3.0.0 or later, the fixed version listed for this product.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data