CVE-2026-25118

MEDIUM EPSS 35.9%

Published Apr 3, 20262mo ago · Modified Jun 17, 20262w ago

6.3 CVSS 4.0

Medium

Published Apr 3, 2026 2mo ago

Last Modified Jun 17, 2026 2w ago

Description

immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable to credential disclosure when a user authenticates to a shared album. During the authentication process, the application transmits the album password within the URL query parameters in a GET request to /api/shared-links/me. This exposes the password in browser history, proxy and server logs, and referrer headers, allowing unintended disclosure of authentication credentials. The impact of this vulnerability is the potential compromise of shared album access and unauthorized exposure of sensitive user data. This issue has been patched in version 2.6.0.

CVSS Details

Base Score

6.3

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope X

Threat Intelligence

EPSS Exploit Probability

35.9% percentile

Exploit & Patch Status

Public Exploit Known

Patch Available

Weaknesses 1

CWE-598

Affected Products 1

Vendor	Product	Version	Range
futo	immich	*	<2.6.0

References 4

github.com https://github.com/immich-app/immich/pull/26868

Issue TrackingPatch
github.com https://github.com/immich-app/immich/pull/26886

Issue TrackingPatch
github.com https://github.com/immich-app/immich/releases/tag/v2.6.0

ProductRelease Notes
github.com https://github.com/immich-app/immich/security/advisories/GHSA-78x4-6x83-jx75

ExploitMitigationVendor Advisory

Remediation

github.com https://github.com/immich-app/immich/pull/26868

Issue TrackingPatch
github.com https://github.com/immich-app/immich/pull/26886

Issue TrackingPatch