Vulnerability in Futo Immich
CVE-2026-25118
immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable to credential disclosure when a user authenticates to a shared album. During the authentication process, the application transmits the album password within the URL query parameters in a GET request to /api/shared-links/me. This exposes the password in browser history, proxy and server logs, and referrer headers, allowing unintended disclosure of authentication credentials. The impact of this vulnerability is the potential compromise of shared album access and unauthorized exposure of sensitive user data. This issue has been patched in version 2.6.0.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.005 (40.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 40th percentile — 40.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.005 · change: +0.000
Affected products
- Futo Immich
- Immich-App Immich — versions < 2.6.0
Weakness classification (CWE)
References
- https://github.com/immich-app/immich/security/advisories/GHSA-78x4-6x83-jx75 (Exploit, Mitigation, Vendor Advisory)
- https://github.com/immich-app/immich/pull/26868 (Patch, Issue Tracking)
- https://github.com/immich-app/immich/pull/26886 (Patch, Issue Tracking)
- https://github.com/immich-app/immich/releases/tag/v2.6.0 (Product, Release Notes)
Frequently asked questions
- What is CVE-2026-25118?
- CVE-2026-25118 is a high-severity vulnerability in Futo Immich, classified under CWE-598. CVSS score: 7.5/10. Published 2026-04-03.
- How severe is CVE-2026-25118?
- High severity. CVSS v3 base score is 7.5 out of 10.