{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25118", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-29T14:03:42.539Z", "datePublished": "2026-04-03T15:51:07.171Z", "dateUpdated": "2026-04-03T15:51:07.171Z"}, "containers": {"cna": {"title": "immich-server: Insecure Transmission of Authentication Credentials via Password Parameter in HTTP Request Query String When Accessing Shared Albums", "problemTypes": [{"descriptions": [{"cweId": "CWE-598", "lang": "en", "description": "CWE-598: Use of GET Request Method With Sensitive Query Strings", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/immich-app/immich/security/advisories/GHSA-78x4-6x83-jx75", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/immich-app/immich/security/advisories/GHSA-78x4-6x83-jx75"}, {"name": "https://github.com/immich-app/immich/pull/26868", "tags": ["x_refsource_MISC"], "url": "https://github.com/immich-app/immich/pull/26868"}, {"name": "https://github.com/immich-app/immich/pull/26886", "tags": ["x_refsource_MISC"], "url": "https://github.com/immich-app/immich/pull/26886"}, {"name": "https://github.com/immich-app/immich/releases/tag/v2.6.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/immich-app/immich/releases/tag/v2.6.0"}], "affected": [{"vendor": "immich-app", "product": "immich", "versions": [{"version": "< 2.6.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-03T15:51:07.171Z"}, "descriptions": [{"lang": "en", "value": "immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable to credential disclosure when a user authenticates to a shared album. During the authentication process, the application transmits the album password within the URL query parameters in a GET request to /api/shared-links/me. This exposes the password in browser history, proxy and server logs, and referrer headers, allowing unintended disclosure of authentication credentials. The impact of this vulnerability is the potential compromise of shared album access and unauthorized exposure of sensitive user data. This issue has been patched in version 2.6.0."}], "source": {"advisory": "GHSA-78x4-6x83-jx75", "discovery": "UNKNOWN"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable to credential disclosure when a user authenticates to a shared album. During the authentication process, the application transmits the album password within the URL query parameters in a GET request to /api/shared-links/me. This exposes the password in browser history, proxy and server logs, and referrer headers, allowing unintended disclosure of authentication credentials. The impact of this vulnerability is the potential compromise of shared album access and unauthorized exposure of sensitive user data. This issue has been patched in version 2.6.0."}], "id": "CVE-2026-25118", "lastModified": "2026-04-03T16:16:36.023", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-04-03T16:16:36.023", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/immich-app/immich/pull/26868"}, {"source": "security-advisories@github.com", "url": "https://github.com/immich-app/immich/pull/26886"}, {"source": "security-advisories@github.com", "url": "https://github.com/immich-app/immich/releases/tag/v2.6.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/immich-app/immich/security/advisories/GHSA-78x4-6x83-jx75"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-598"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.6.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "immich", "source": "cna", "vendor": "immich-app"}, "product": "immich", "vendor": "immich-app"}], "analysis": {"en": {"generated_at": "2026-04-03T18:35:50.446785+00:00", "value": {"mitigation_remediation": ["Upgrade immich to version 2.6.0 or later."], "summary": {"action": "Patch Now", "impact": "Credential Disclosure"}, "threat_synthesis": {"affected_systems": "All installations of the immich photo and video management solution running a version earlier than 2.6.0 are vulnerable. The issue was patched in immich v2.6.0 and later releases.", "description_and_impact": "The immich application transmits the password that authenticates a user to a shared album in the URL query string of a GET request to /api/shared-links/me. This exposes the password in browser history, proxy logs, server logs, and referrer headers, allowing unintended disclosure of authentication credentials. The result is potential compromise of shared album access and unauthorized exposure of sensitive user data. The weakness is a classic credential transmission flaw (CWE\u2011598).", "risk_and_exploitability": "The vulnerability carries a CVSS score of 6.3, indicating moderate severity. No EPSS score is available, and it is not listed in the CISA KEV catalog, suggesting limited evidence of active exploitation. Based on the description, the likely attack vector is remote interception or observation of the GET request that includes the password in the query string, allowing an attacker to retrieve the credentials from logs or network traffic. The exploit requires no user interaction beyond accessing the shared album, making it relatively straightforward for an adversary to leverage."}}}}, "created": "2026-04-03T21:12:57.142181+00:00", "updated": "2026-04-03T21:15:09.222777+00:00", "vendors": ["immich-app", "immich-app$PRODUCT$immich"]}