Immich Server CVE-2026-119329

Requires an established view-only partner-sharing relationship: the attacker must be an authenticated low-privilege user whom the victim has accepted as a partner, and the victim must have archived assets carrying GPS metadata. The attacker then sets both withPartners=true and isArchived=true on GET /api/map/markers - the isArchived=true parameter is the specific trigger, as the contrast run (isArchived=false) correctly hides the assets. Limiting factors that reduce real-world risk: exploitation is confined to people the victim explicitly partnered with (not arbitrary remote attackers), no user interaction by the victim is needed, and the exposure is strictly location metadata and asset identifiers - image bytes remain protected by checkPartnerAccess.

This is a genuine but low-severity authorization/privacy flaw, not a high-urgency emergency. The vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3 Medium) is internally consistent with the description: exploitation is over the network (AV:N), trivial (AC:L), requires an authenticated low-privilege actor (PR:L - specifically an accepted view-only partner), needs no user interaction (UI:N), and yields only limited confidentiality impact (C:L) with no integrity or availability loss. The SSVC-style 'this_month' decision label from vuln.today aligns with that: real but not act_now/emergency. A verified proof-of-concept is included in the advisory (poc.zip, reproduced 3/3 on v2.7.5), which raises practical exploitability, but this is still a bounded metadata-disclosure issue, not code execution or bulk data theft. No EPSS score was supplied and the CVE is NOT on the CISA KEV list, so there is no evidence of active exploitation - the signals point to a targeted privacy violation within an existing partner relationship rather than widespread opportunistic abuse. The main caveat: EPSS is missing from the input, so probabilistic exploitation likelihood cannot be cross-checked against the PoC availability.

An Immich user shares their library view-only with a partner (e.g. a family member or ex-partner). That partner, authenticated to their own account, calls GET /api/map/markers?withPartners=true&isArchived=true and receives the GPS coordinates and asset IDs of the sharer's deliberately archived (hidden) photos and videos. A working PoC verifying this leak (returning lat/lon of an archived asset) is attached to the GHSA advisory and was reproduced on v2.7.5.