Immich releases up to 3.3.1 contain a missing authorization check in the partner synchronization stream. An authenticated partner can call the sync endpoint and retrieve metadata from assets located in locked folders. The exposed data include GPS coordinates, capture times, descriptions, and camera details, which represent a confidentiality breach but do not enable code execution or broad system compromise.

The flaw affects the immich-app::immich product in all releases up to and including version 3.3.1. Users running these versions, particularly those who have enabled partner synchronization, are at risk. The vulnerability is present in Docker deployments as indicated by the CPE string, but the issue is independent of the deployment method.

The CVSS score of 5.3 indicates medium severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation reports yet. The attack vector requires an active, authenticated partner relationship; an attacker must first establish or possess a valid partner link to send the POST /api/sync/stream request with PartnerAssetsV2 or PartnerAssetExifsV1 payloads. Consequently, the vulnerability is limited to partners and does not pose a remote uncontrolled access risk without such a relationship.