PT-2026-30190 · Immich · Immich

Rvizx · Published 2026-04-03 · Updated 2026-04-03 · CVE-2026-25118

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions imich versions prior to 2.6.0

Description Prior to version 2.6.0, the Immich application discloses credentials when a user authenticates to a shared album. The application transmits the album password within the URL query parameters in a GET request to the /api/shared-links/me endpoint. This exposes the password in browser history, proxy logs, server logs, and referrer headers, potentially leading to unauthorized access to shared albums and exposure of user data.

Recommendations Update to version 2.6.0 or later.

Fix

Weakness Enumeration

CWE-598

Related Identifiers

CVE-2026-25118

Affected Products

Immich

References · 6

• https://github.com/immich-app/immich/security/advisories/GHSA-78x4-6x83-jx75 · Vendor Advisory
• https://github.com/immich-app/immich/pull/26868 · Patch
• https://github.com/immich-app/immich/pull/26886 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25118 · Security Note
• https://github.com/immich-app/immich/releases/tag/v2.6.0 · Note
• https://twitter.com/CVEnew/status/2040111814311305457 · Twitter Post