Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST /api/sync/stream with PartnerAssetsV2 and PartnerAssetExifsV1 types to obtain GPS coordinates, capture times, descriptions and camera details.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Futo Immich
cpe:2.3:a:futo:immich:*:*:*:*:*:docker:*:*
|
— |
<= 3.3.1
|
References 5
https://github.com/immich-app/immich
disclosure@vulncheck.com
https://github.com/immich-app/immich/blob/db6e11ecc851228aec9c525abb0ee026d1f50…
disclosure@vulncheck.com
https://github.com/immich-app/immich/blob/db6e11ecc851228aec9c525abb0ee026d1f50…
disclosure@vulncheck.com
https://hackmd.io/@haind/immich-partner-sync-locked-metadata
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/immich-through-3.3.1-missing-authorization…
disclosure@vulncheck.com