← Vulnerability feed

Vulnerability record · CVE-2026-25118 · published 3 April 2026

CVE-2026-25118: Futo immich vulnerability

Futo · Immich

immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable to credential disclosure when a user authenticates to a shared album. During the authentication process, the application transmits the album password within the URL query parameters in a GET request to /api/shared-links/me. This exposes the password in browser history, proxy and server logs, and referrer headers, allowing unintended disclosure of authentication credentials. The impact of this vulnerability is the potential compromise of shared album access and unauthorized exposure of sensitive user data. This issue has been patched in version 2.6.0.

6.3 CVSS 4.0 Medium EPSS 0.45% · top 63.4% CWE-598 · CWE-598
6.3CVSS 4.0 base score
0.45%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 1 tagged exploit
24 Jul 2026Last modified by NVD

Description

immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable to credential disclosure when a user authenticates to a shared album. During the authentication process, the application transmits the album password within the URL query parameters in a GET request to /api/shared-links/me. This exposes the password in browser history, proxy and server logs, and referrer headers, allowing unintended disclosure of authentication credentials. The impact of this vulnerability is the potential compromise of shared album access and unauthorized exposure of sensitive user data. This issue has been patched in version 2.6.0.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/immich-app/immich/pull/26868 Issue TrackingPatch
https://github.com/immich-app/immich/pull/26886 Issue TrackingPatch
https://github.com/immich-app/immich/releases/tag/v2.6.0 ProductRelease Notes
https://github.com/immich-app/immich/security/advisories/GHSA-78x4-6x83-jx75 ExploitMitigationVendor Advisory

Track CVE-2026-25118 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-23896Futo immich improper privilege management vulnerabilityimmich is a high performance self-hosted photo and video management solution. Prior to version 2.5.0, API keys can escalate their own permissions by …EPSS 0.35%5.4CVE-2026-35455Futo immich cross-site scripting vulnerabilityimmich is a high performance self-hosted photo and video management solution. Prior to 2.7.0, sStored Cross-Site Scripting (XSS) in the 360° panorama…EPSS 0.26%5.1CVE-2026-40096Futo immich cross-site scripting vulnerabilityimmich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open redirect vulnerability in the s…EPSS 0.24%

Source: NIST National Vulnerability Database (record CVE-2026-25118), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.