CVE-2026-25118

immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable to credential disclosure when a user authenticates to a shared album. During the authentication process, the application transmits the album password within the URL query parameters in a GET request to /api/shared-links/me. This exposes the password in browser history, proxy and server logs, and referrer headers, allowing unintended disclosure of authentication credentials. The impact of this vulnerability is the potential compromise of shared album access and unauthorized exposure of sensitive user data. This issue has been patched in version 2.6.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/immich-app/immich/pull/26868	Issue Tracking Patch
https://github.com/immich-app/immich/pull/26886	Issue Tracking Patch
https://github.com/immich-app/immich/releases/tag/v2.6.0	Product Release Notes
https://github.com/immich-app/immich/security/advisories/GHSA-78x4-6x83-jx75	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:futo:immich:*:*:*:*:*:docker:*:*

History

No history.

Information

Published : 2026-04-03 16:16

Updated : 2026-07-24 22:10

NVD link : CVE-2026-25118

Mitre link : CVE-2026-25118

CVE.ORG link : CVE-2026-25118

JSON object : View

Products Affected

futo

immich

CWE

CWE-598

Use of HTTP Request With Sensitive Query String

{"id": "CVE-2026-25118", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25118", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-04T03:18:41.382687Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "immich-app", "product": "immich", "versions": [{"status": "affected", "version": "< 2.6.0"}]}]}], "published": "2026-04-03T16:16:36.023", "references": [{"url": "https://github.com/immich-app/immich/pull/26868", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/immich-app/immich/pull/26886", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/immich-app/immich/releases/tag/v2.6.0", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/immich-app/immich/security/advisories/GHSA-78x4-6x83-jx75", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-598"}]}], "descriptions": [{"lang": "en", "value": "immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable to credential disclosure when a user authenticates to a shared album. During the authentication process, the application transmits the album password within the URL query parameters in a GET request to /api/shared-links/me. This exposes the password in browser history, proxy and server logs, and referrer headers, allowing unintended disclosure of authentication credentials. The impact of this vulnerability is the potential compromise of shared album access and unauthorized exposure of sensitive user data. This issue has been patched in version 2.6.0."}, {"lang": "es", "value": "immich es una soluci\u00f3n de gesti\u00f3n de fotos y videos autoalojada de alto rendimiento. Antes de la versi\u00f3n 2.6.0, la aplicaci\u00f3n Immich es vulnerable a la divulgaci\u00f3n de credenciales cuando un usuario se autentica en un \u00e1lbum compartido. Durante el proceso de autenticaci\u00f3n, la aplicaci\u00f3n transmite la contrase\u00f1a del \u00e1lbum dentro de los par\u00e1metros de consulta de la URL en una solicitud GET a /api/shared-links/me. Esto expone la contrase\u00f1a en el historial del navegador, los registros del proxy y del servidor, y los encabezados de referencia, permitiendo la divulgaci\u00f3n no intencionada de credenciales de autenticaci\u00f3n. El impacto de esta vulnerabilidad es el compromiso potencial del acceso al \u00e1lbum compartido y la exposici\u00f3n no autorizada de datos sensibles del usuario. Este problema ha sido parcheado en la versi\u00f3n 2.6.0."}], "lastModified": "2026-07-24T22:10:00.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:futo:immich:*:*:*:*:*:docker:*:*", "vulnerable": true, "matchCriteriaId": "8E154324-7B08-40A1-9BA3-A7ABE51E6F05", "versionEndExcluding": "2.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}