---
id: "CVE-2026-119329"
kind: "vulnerability"
aliases: ["CVE-2026-119329"]
title: "Immich: partner users can see locations of archived photos"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["immich", "package", "photo-management", "self-hosted"]
not_affected_if: ["no-partner-sharing", "version-3.0.0-or-later"]
published_at: "2026-10-30T20:17:06+00:00"
first_seen_at: "2026-10-30T20:25:37+00:00"
updated_at: "2026-10-30T20:26:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119329", "first_seen_at": "2026-10-30T20:25:37+00:00"}]
---

# Immich: partner users can see locations of archived photos

Immich's map endpoint, when partner sharing is on, lets a view-only partner list GPS coordinates and identifiers of a sharer's archived photos and videos. Image bytes stay protected, so the exposure is location metadata and asset IDs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Immich server version; affected if below `3.0.0`
- Confirm whether partner sharing is used (withPartners on GET /api/map/markers)

## Fix

- Immich: move to `3.0.0` or later

## Timeline

- 2026-10-30T20:25:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119329

## From the sources

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers used server/src/services/map.service.ts to add partner owner identifiers when withPartners=true, while server/src/repositories/map.repository.ts applied Archive visibility to every selected owner when isArchived=true. A view-only partner could therefore enumerate the GPS coordinates and existence of a sharer's archived photos or videos even though the timeline and direct-access paths exclude archived partner assets. The exposure is limited to location metadata and asset identifiers because image bytes remain protected by checkPartnerAccess. This issue is fixed in version 3.0.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_