CVE-2026-25118 Information disclosure in immich

Medium 6.3 Published 3 Apr 2026 Updated 4 Apr 2026

Attackers can steal shared album passwords from URL logs, leading to unauthorized access to private media and user data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-25118?

CVE-2026-25118 is a medium-severity vulnerability in immich-app immich, published on 3 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable to credential disclosure when a user authenticates to a shared album. During the authentication process, the application transmits the album password within the URL query parameters in a GET request to /api/shared-links/me. This exposes the password in browser history, proxy and server logs, and referrer headers, allowing unintended disclosure of authentication credentials. The impact of this vulnerability is the potential compromise of shared album access and unauthorized exposure of sensitive user data. This issue has been patched in version 2.6.0.

Weakness: CWE-598

Which versions are affected by CVE-2026-25118?

It affects 1 product.

Products include Futo Immich.

How do I fix CVE-2026-25118?

No fix has been published for CVE-2026-25118 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-25118 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25118 exists.

Sources

Also known as GHSA-78x4-6x83-jx75.