CVE-2026-119329

    Dashboard / Vulnerabilities / CVE-2026-119329

    CVE-2026-119329

    Published: 30 Oct 2026Last Modified: 4 Nov 2026

    Summary: Immich: Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers

    Details: Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers used server/src/services/map.service.ts to add partner owner identifiers when withPartners=true, while server/src/repositories/map.repository.ts applied Archive visibility to every selected owner when isArchived=true. A view-only partner could therefore enumerate the GPS coordinates and existence of a sharer's archived photos or videos even though the timeline and direct-access paths exclude archived partner assets. The exposure is limited to location metadata and asset identifiers because image bytes remain protected by checkPartnerAccess. This issue is fixed in version 3.0.0.

    References: https://github.com/immich-app/immich/releases/tag/v3.0.0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119329.json, https://github.com/immich-app/immich/security/advisories/GHSA-hv27-723h-qfjq, https://nvd.nist.gov/vuln/detail/CVE-2026-119329, https://github.com/immich-app/immich/commit/b633cc4f046f198bc11648c486e1e6e3f19d26d5, https://github.com/immich-app/immich/pull/29028

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -05d838b560d5e9316e6512af2af692975a82bb45

    Affected versions

    v3.0.0-rc.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-119329 | CVE-DB