Repository navigation
Server leaks server config and features to anonymous users #32859
Description
I have searched the existing issues, both open and closed, to make sure this is not a duplicate report.
- Yes
The bug
You get information that you have absolutely no need or business knowing as an anonymous user.
The OS that Immich Server is running on
Docker
Version of Immich Server
v3.3.5
Version of Immich Mobile App
v3.3.5
Platform with the issue
- Server
- Web
- Mobile
Device make and model
No response
Your docker-compose.yml content
# vim: sw=2 ts=2 expandtab
name: immich
services:
immich-server:
container_name: immich_server
image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
volumes:
- ${UPLOAD_LOCATION}:/data
- /etc/localtime:/etc/localtime:ro
env_file:
- .env
ports:
- '2283:2283'
depends_on:
- redis
- database
restart: always
healthcheck:
disable: false
immich-machine-learning:
container_name: immich_machine_learning
image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
volumes:
- model-cache:/cache
env_file:
- .env
restart: always
healthcheck:
disable: false
redis:
container_name: immich_redis
image: docker.io/valkey/valkey:9@sha256:c123e3715db63d06d4ad6964884037aa0d5d4d703939b9929954112889708e1d
healthcheck:
test: redis-cli ping | grep -q PONG || exit 1
restart: always
database:
container_name: immich_postgres
image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
environment:
POSTGRES_PASSWORD: ${DB_PASSWORD}
POSTGRES_USER: ${DB_USERNAME}
POSTGRES_DB: ${DB_DATABASE_NAME}
POSTGRES_INITDB_ARGS: '--data-checksums'
volumes:
- ${DB_DATA_LOCATION}:/var/lib/postgresql/data
shm_size: 128mb
restart: always
healthcheck:
disable: false
volumes:
model-cache:Your .env content
# You can find documentation for all the supported env variables at https://docs.immich.app/install/environment-variables
# The location where your uploaded files are stored
UPLOAD_LOCATION=./library
# The location where your database files are stored. Network shares are not supported for the database
DB_DATA_LOCATION=./postgres
# To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List
TZ=Etc/UTC
# The Immich version to use. You can pin this to a specific version like "v2.1.0"
IMMICH_VERSION=v3
# Connection secret for postgres. You should change it to a random password
# Please use only the characters `A-Za-z0-9`, without special characters or spaces
DB_PASSWORD=redacted
# The values below this line do not need to be changed
###################################################################################
DB_USERNAME=postgres
DB_DATABASE_NAME=immichReproduction steps
- Go to /api/server/config or /api/server/features
Relevant log output
Additional information
If this is an intentional feature, then I'd like to know why a logged-out user needs to know my storage space or if I have OCR enabled or not just to watch media from a share link. Or why the web client refuses to play the shared video just because it can't access that information.
I apologize if I come across as a bit rude, but I can be considered somewhat of a paranoid privacy freak, so to find out that my server is leaking this sort of information and it not letting me stop the leak without breaking down feels very exposing to me.
Reacted by FrostBird347
Activity
bo0tzz commentedon Nov 1, 2026
Which of these do you consider sensitive?