GPS Data Exposure in Immich Photo Management Solution

CVE-2026-119329

What is CVE-2026-119329?

The vulnerability in Immich, a self-hosted photo and video management solution, allows view-only partners to access GPS coordinates and metadata of archived photos or videos, despite timelines and direct-access methods excluding these archived assets. This issue arises when partner owner identifiers are improperly handled in the API. Although the underlying image data remain secure, the exposure of location metadata poses privacy concerns for users. The issue has been addressed in version 3.0.0.

References