CVE-2026-119329

The Immich photo and video management solution contains a vulnerability prior to version 3.0.0 . The GET /api/map/markers endpoint incorrectly processes partner owner identifiers in server/src/services/map.service.ts while applying archive visibility in server/src/repositories/map.repository.ts. ...

CVE-2026-119329 Immich: Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers used server/src/services/map.service.ts to add partner owner identifiers when withPartners=true, while server/src/repositories/map.repository.ts applied Archive visibility to every...

CVE-2026-119329: immich-app immich: Immich is a high-performance self-hosted photo and video management solution

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers used server/src/services/map.service.ts to add partner owner identifiers when withPartners=true, while server/src/repositories/map.repository.ts applied Archive visibility to every...