CVE-2026-108165: Immich Partner Sync Auth Bypass Vulnerability

CVE-2026-108165 Overview

CVE-2026-108165 is a missing authorization vulnerability [CWE-862] in the Immich self-hosted photo and video backup platform through version 3.3.1. The flaw resides in the partner synchronization stream, where sync queries fail to exclude assets marked with Locked visibility. Authenticated users with an active partner relationship can retrieve metadata for assets stored in a partner's Locked Folder, including GPS coordinates, capture timestamps, descriptions, and camera details. The exposure occurs through the POST /api/sync/stream endpoint when requesting the PartnerAssetsV2 and PartnerAssetExifsV1 sync types.

Critical Impact

Authenticated partners can read sensitive metadata, including geolocation and timestamps, from assets intended to remain private in Locked Folders.

Affected Products

• Immich self-hosted photo and video backup server
• All Immich releases through version 3.3.1
• Deployments using the partner sharing feature with Locked Folder assets

Discovery Timeline

• 2026-10-10 - CVE CVE-2026-108165 published to NVD
• 2026-10-10 - Last updated in NVD database

Technical Details for CVE-2026-108165

Vulnerability Analysis

Immich allows users to designate assets as part of a Locked Folder, a privacy feature intended to hide sensitive media from standard views and shared contexts. The partner sharing feature grants another user read access to a sharer's library, but Locked Folder assets must be excluded from that scope. In versions through 3.3.1, the partner synchronization pipeline does not apply a visibility filter when streaming asset records to a partner. The result is an authorization gap between the intended access policy and the server-side query logic.

An attacker who already holds a legitimate partner relationship with a target user can invoke the sync stream endpoint and receive metadata for Locked assets they should never see. While image binaries are not directly returned, the exposed EXIF metadata includes GPS coordinates, capture time, descriptions, and camera identifiers that can reveal location history and sensitive personal context.

Root Cause

The defect is a missing authorization check in the sync repository logic. According to the referenced source in sync.repository.ts, the partner asset query selects assets owned by the sharing user without filtering out rows where visibility is set to Locked. The related access.repository.ts similarly fails to restrict partner access to non-Locked assets.

Attack Vector

Exploitation requires network access to the Immich API and a valid session on an account that is an active partner of the victim. The attacker sends a POST /api/sync/stream request specifying the PartnerAssetsV2 and PartnerAssetExifsV1 sync types. The server streams asset and EXIF records belonging to the partner, including those marked Locked, which the client can then parse to recover metadata.

Further technical analysis is available in the VulnCheck advisory on Immich and the HackMD Immich partner sync writeup.

Detection Methods for CVE-2026-108165

Indicators of Compromise

• Unusual volume of POST /api/sync/stream requests from a single partner account over a short interval.
• Sync stream requests containing both PartnerAssetsV2 and PartnerAssetExifsV1 types from accounts that rarely use partner sync.
• Partner accounts created or accepted shortly before a burst of sync activity.

Detection Strategies

• Enable verbose API access logging on the Immich server and parse request bodies for sync type parameters.
• Correlate sync stream requests with the asset visibility field in the database to identify responses that included Locked records.
• Baseline normal partner sync behavior per user and alert on deviations in request frequency or payload size.

Monitoring Recommendations

• Forward Immich application and reverse proxy logs to a centralized log platform for retention and query.
• Monitor for new partner relationships that precede large sync downloads.
• Review partner lists periodically and flag unexpected or dormant partner accounts for revocation.

How to Mitigate CVE-2026-108165

Immediate Actions Required

• Upgrade Immich to a version later than 3.3.1 that includes the authorization fix for partner sync queries.
• Audit all active partner relationships and remove partners that are no longer required.
• Temporarily disable partner sharing for accounts that store sensitive content in Locked Folders until patching is complete.

Patch Information

Refer to the Immich project repository for the latest release notes and the specific commit that filters Locked visibility assets from partner sync responses. The vulnerable logic is located in the sync and access repositories referenced in the upstream source code.

Workarounds

• Remove partner relationships for any account that uses the Locked Folder feature until the upgrade is applied.
• Restrict external network access to the Immich API using a reverse proxy, VPN, or allowlist to limit who can call /api/sync/stream.
• Move highly sensitive media out of the server entirely until the installation is confirmed to be running a patched version.

# Example reverse proxy rule to restrict the sync endpoint to trusted networks
# nginx snippet
location /api/sync/stream {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://immich-server:3001;
}