CVE-2026-108165: falha de média gravidade em immich-app immich
Immich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadata
Publicada em
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 5.3epss 0.2%
probabilidade de exploração
0.2%top 91% das CVEs
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST /api/sync/stream with PartnerAssetsV2 and PartnerAssetExifsV1 types to obtain GPS coordinates, capture times, descriptions and camera details.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
immich-app · immichPoCs públicas encontradas — 1
cve_referencehackmd.io/@haind/immich-partner-sync-locked-metadatanão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — immich-app immich
No mesmo produto, das mais perigosas para as menos.
CVE-2026-59258HIGHimmich < 3.0.3 Shared Album Editor Ownership Takeover via updateUserEPSS 0.5%CVE-2026-25118MEDIUMimmich-server: Insecure Transmission of Authentication Credentials via Password Parameter in HTTP Request Query String When Accessing Shared AlbumsEPSS 0.4%CVE-2026-82272HIGHImmich Locked Assets Remain Readable Through Albums and Shared LinksEPSS 0.4%CVE-2025-43856HIGHimmich allows account hijacking through oauth2EPSS 0.4%CVE-2026-53662CRITICALimmich: One-click account takeover via XSS in login page continue redirectEPSS 0.4%CVE-2026-23896HIGHimmich API Key Privilege Escalation vulnerabilityEPSS 0.3%
Referências
https://github.com/immich-app/immichhttps://github.com/immich-app/immich/blob/db6e11ecc851228aec9c525abb0ee026d1f5055e/server/src/repositories/access.repository.ts#L207-L228https://github.com/immich-app/immich/blob/db6e11ecc851228aec9c525abb0ee026d1f5055e/server/src/repositories/sync.repository.ts#L662-L722https://hackmd.io/@haind/immich-partner-sync-locked-metadatahttps://www.vulncheck.com/advisories/immich-through-3.3.1-missing-authorization-in-partner-sync-exposes-locked-folder-metadata