# CVE-2026-119329: Immich information disclosure in map markers API

Source: https://junglewise.ai/threats/cve-2026-119329-immich-is-a-high-performance-self-hosted-photo-and-video  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119329 · Severity: medium · CVSS 4.3 · Published 2026-10-30

Immich is a self-hosted photo and video management application. A flaw in the map markers API allowed view-only partners to discover GPS coordinates and existence of archived photos and videos belonging to other users, circumventing access restrictions that should hide archived assets from partners. While the actual image files remain protected, the location metadata exposure could reveal sensitive movement patterns or private locations.

Technologies: [Immich](https://junglewise.ai/threats/technologies/immich). Vendors: [Immich](https://junglewise.ai/threats/vendors/immich).

## Quick answers

**Is CVE-2026-119329 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119329 being exploited in the wild.

**How severe is CVE-2026-119329?** Medium severity, with a CVSS score of 4.3, published 30 October 2026.

**Which products and versions are affected?** Immich before 3.0.0.

**Is there a fix for CVE-2026-119329?** Yes: fixed in 3.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119329 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-119329?** Check whether you run Immich at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.0.0

## Technical details

The GET /api/map/markers endpoint in Immich prior to 3.0.0 failed to properly enforce per-owner archive visibility when processing partner-shared assets. The map service added partner identifiers when withPartners=true, but the repository layer applied archive filtering at the query level rather than per-owner, allowing archived assets owned by the authenticated user to leak location metadata to view-only partners. An authenticated partner user could enumerate GPS coordinates and asset IDs by querying with both withPartners=true and isArchived=true parameters.

## Affected products

- Immich Immich before 3.0.0

## Timeline

- 2026-10-30: disclosed
- 2026-06-15: patched

## References

- [https://github.com/immich-app/immich/commit/b633cc4f046f198bc11648c486e1e6e3f19d26d5](https://github.com/immich-app/immich/commit/b633cc4f046f198bc11648c486e1e6e3f19d26d5)
- [https://github.com/immich-app/immich/pull/29028](https://github.com/immich-app/immich/pull/29028)

## Related threats

- [Immich unauthorized album owner role modification](https://junglewise.ai/threats/cve-2026-77439-immich-is-a-self-hosted-photo-and-video-management-solution-prior)
- [Immich calendar heatmap unauthorized access vulnerability](https://junglewise.ai/threats/cve-2026-104867-immich-is-a-high-performance-self-hosted-photo-and-video)
- [Immich missing authorization in partner sync stream](https://junglewise.ai/threats/cve-2026-108165-immich-through-3-3-1-contains-a-missing-authorization)
- [Immich SVG upload to ImageMagick remote code execution](https://junglewise.ai/threats/cve-2026-105764-immich-is-a-high-performance-self-hosted-photo-and-video)
- [Immich locked asset visibility bypass in shared albums](https://junglewise.ai/threats/cve-2026-82272-immich-locked-asset-visibility-bypass-in-shared-albums)