CVE-2026-25118

immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable to credential disclosure when a user authenticates to a shared album. During the authentication process, the application transmits the album password within the URL query parameters in a GET request to /api/shared-links/me. This exposes the password in browser history, proxy and server logs, and referrer headers, allowing unintended disclosure of authentication credentials. The impact of this vulnerability is the potential compromise of shared album access and unauthorized exposure of sensitive user data. This issue has been patched in version 2.6.0.

• CWE-598

• https://github.com/immich-app/immich/pull/26868Issue Tracking, Patch
• https://github.com/immich-app/immich/pull/26886Issue Tracking, Patch
• https://github.com/immich-app/immich/releases/tag/v2.6.0Product, Release Notes
• https://github.com/immich-app/immich/security/advisories/GHSA-78x4-6x83-jx75Exploit, Mitigation, Vendor Advisory

Published

Apr 3, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25112A high-severity vulnerability in the deployment of Genetec R…7.8
• CVE-2026-25113The WebSocket Application Programming Interface lacks restri…9.8
• CVE-2026-25114The WebSocket Application Programming Interface lacks restri…9.8
• CVE-2026-25115n8n is an open source workflow automation platform. Prior to…9.9
• CVE-2026-25116Runtipi is a personal homeserver orchestrator. Starting in v…8.8
• CVE-2026-25117pwn.college DOJO is an education platform for learning cyber…8.3
• CVE-2026-25119Gogs is an open source self-hosted Git service. Prior to 0.1…7.7
• CVE-2026-2512The Code Embed plugin for WordPress is vulnerable to Stored …6.4
• CVE-2026-25120Gogs is an open source self-hosted Git service. In versions …2.7
• CVE-2026-25121apko allows users to build and publish OCI container images …7.5
• CVE-2026-25122apko allows users to build and publish OCI container images …5.5
• CVE-2026-25123Homarr is an open-source dashboard. Prior to 1.52.0, a publi…5.3