{"id":"CVE-2026-119329","kind":"vulnerability","aliases":["CVE-2026-119329"],"related":[],"title":"Immich: partner users can see locations of archived photos","description":"Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers used server/src/services/map.service.ts to add partner owner identifiers when withPartners=true, while server/src/repositories/map.repository.ts applied Archive visibility to every selected owner when isArchived=true. A view-only partner could therefore enumerate the GPS coordinates and existence of a sharer's archived photos or videos even though the timeline and direct-access paths exclude archived partner assets. The exposure is limited to location metadata and asset identifiers because image bytes remain protected by checkPartnerAccess. This issue is fixed in version 3.0.0.","summary":"Immich's map endpoint, when partner sharing is on, lets a view-only partner list GPS coordinates and identifiers of a sharer's archived photos and videos. Image bytes stay protected, so the exposure is location metadata and asset IDs.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["immich","package","photo-management","self-hosted"],"not_affected_if":["no-partner-sharing","version-3.0.0-or-later"],"how_to_check":"- Check the Immich server version; affected if below `3.0.0`\n- Confirm whether partner sharing is used (withPartners on GET /api/map/markers)","fix":"- Immich: move to `3.0.0` or later","status":"open","published_at":"2026-10-30T20:17:06+00:00","first_seen_at":"2026-10-30T20:25:37+00:00","triaged_at":"2026-10-30T20:26:53+00:00","updated_at":"2026-10-30T20:26:53+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T20:26:53Z","model":"claude-haiku-5-5","output":{"fix":"- Immich: move to `3.0.0` or later","reach":"network","title":"Immich: partner users can see locations of archived photos","impact":"low","summary":"Immich's map endpoint, when partner sharing is on, lets a view-only partner list GPS coordinates and identifiers of a sharer's archived photos and videos. Image bytes stay protected, so the exposure is location metadata and asset IDs.","audience":"businesses","category":"package","nicknames":[],"who_cares":["immich","self-hosted","photo-management"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"partner reads GPS locations and IDs of archived photos","analyst_note":"","how_to_check":"- Check the Immich server version; affected if below `3.0.0`\n- Confirm whether partner sharing is used (withPartners on GET /api/map/markers)","plain_action":"","needs_analyst":false,"not_affected_if":["version-3.0.0-or-later","no-partner-sharing"],"who_is_affected":"Self-hosted Immich servers running versions before 3.0.0 where users share libraries with partners. The exposure is limited to location and identifiers of archived assets visible to a view-only partner; the timeline and direct asset access already exclude archived partner assets. Instances without partner sharing are not exposed through this path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000673,"input_tokens":4236,"output_tokens":498,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119329':12A,15A '-2026':11A,14A '/api/map/markers':83C '3.0.0':81C,163C 'access':134C 'add':87C 'appli':96C 'archiv':8A,48B,97C,123C,137C 'asset':63B,139C,148C 'byte':53B,152C 'checkpartneraccess':156C 'coordin':41B,116C 'could':111C 'cve':10A,13A 'direct':133C 'direct-access':132C 'endpoint':27B 'enumer':113C 'even':127C 'everi':100C 'exclud':136C 'exist':118C 'exposur':58B,141C 'fix':160C 'get':82C 'gps':40B,115C 'high':69C 'high-perform':68C 'host':23B,73C 'id':64B 'identifi':43B,90C,149C 'imag':52B,151C 'immich':1A,16B,24B,65C 'isarchiv':104C 'issu':158C 'let':33B 'limit':143C 'list':39B 'locat':6A,60B,145C 'manag':20B,77C 'map':26B 'metadata':61B,146C 'owner':89C,102C 'packag':17B 'partner':2A,29B,38B,88C,110C,138C 'path':135C 'perform':70C 'photo':9A,19B,49B,74C,124C 'photo-manag':18B 'prior':79C 'protect':55B,154C 'remain':153C 'see':5A 'select':101C 'self':22B,72C 'self-host':21B,71C 'server/src/repositories/map.repository.ts':95C 'server/src/services/map.service.ts':85C 'share':30B 'sharer':46B,121C 'solut':78C 'stay':54B 'therefor':112C 'though':128C 'timelin':130C 'true':93C,105C 'use':84C 'user':3A 'version':162C 'video':51B,76C,126C 'view':36B,108C 'view-on':35B,107C 'visibl':98C 'withpartn':92C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Immich servers running versions before 3.0.0 where users share libraries with partners. The exposure is limited to location and identifiers of archived assets visible to a view-only partner; the timeline and direct asset access already exclude archived partner assets. Instances without partner sharing are not exposed through this path.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T20:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119329","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119329","severity":null,"published_at":"2026-10-30T20:17:06+00:00","modified_at":"2026-10-30T20:17:06+00:00","first_seen_at":"2026-10-30T20:25:37+00:00","fetched_at":"2026-10-30T20:25:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}