Is CVE-2026-108165 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108165 being exploited in the wild.

How severe is CVE-2026-108165?

Medium severity, with a CVSS score of 4.3, published 10 October 2026.

Is there a fix for CVE-2026-108165?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-108165 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-108165?

Check whether you run Immich at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108165: Immich missing authorization in partner sync stream

CVE-2026-108165 · Severity: medium · CVSS 4.3 · Published 2026-10-10

Immich is a self-hosted photo and video management solution. An authenticated partner account can bypass access controls to read metadata (GPS coordinates, timestamps, descriptions, camera details) from photos and videos marked as locked or private, exposing sensitive location and activity information.

Technologies: Immich. Vendors: Immich.

Quick answers

Is CVE-2026-108165 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108165 being exploited in the wild.
How severe is CVE-2026-108165?: Medium severity, with a CVSS score of 4.3, published 10 October 2026.
Which products and versions are affected?: Immich through 3.3.1.
Is there a fix for CVE-2026-108165?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-108165 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-108165?: Check whether you run Immich at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Missing authorization checks in the POST /api/sync/stream endpoint allow authenticated partners to retrieve asset metadata for locked folders via PartnerAssetsV2 and PartnerAssetExifsV1 sync query types. The vulnerability requires an active partner relationship (authentication) and network access to the Immich server. An attacker with partner access gains visibility into metadata that should be restricted by the Locked Folder visibility setting.

Affected products

Immich Immich through 3.3.1

Timeline

2026-10-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.