CVE-2026-40096
Last modified
CVE-2026-40096 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open redirect vulnerability in the shared album functionality, where the album name is inserted unsanitized into a <meta> tag in api.service.ts. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open redirect vulnerability in the shared album functionality, where the album name is inserted unsanitized into a <meta> tag in api.service.ts. A registered attacker can create a shared album with a crafted name containing 0;url=https://attackersite.com" http-equiv="refresh, which when rendered in the <meta property="og:title"> tag causes the victim's browser to redirect to an attacker-controlled site upon opening the share link. This facilitates phishing attacks, as the attacker could host a modified version of immich that collects login credentials from victims who believe they need to authenticate to view the shared album. This issue has been fixed in version 2.7.3.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Futo | Immich | < 2.7.3 |
References
- https://github.com/immich-app/immich/releases/tag/v2.7.3Product, Release Notes
- https://github.com/immich-app/immich/security/advisories/GHSA-24fq-72x8-v7hmExploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-40096?
How severe is CVE-2026-40096?
How do I fix CVE-2026-40096?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-4009A vulnerability has been found in jarikomppa soloud up to 20…3.3
- CVE-2026-40090Zarf is an Airgap Native Packager Manager for Kubernetes. Ve…7.1
- CVE-2026-40091SpiceDB is an open source database system for creating and m…4.4
- CVE-2026-40092nimiq-blockchain provides persistent block storage for Nimiq…7.5
- CVE-2026-40093nimiq-blockchain provides persistent block storage for Nimiq…8.1
- CVE-2026-40094nimiq-blockchain provides persistent block storage for Nimiq…4.3
- CVE-2026-40097Step CA is an online certificate authority for secure, autom…3.7
- CVE-2026-40098Magento Long Term Support (LTS) is an unofficial, community-…5.4
- CVE-2026-40099Kirby is an open-source content management system. Kirby's u…6.5
- CVE-2026-4010A vulnerability was found in ThakeeNathees pocketlang up to …3.3
- CVE-2026-40100FastGPT is an AI Agent building platform. Prior to 4.14.10.3…5.3
- CVE-2026-40102Plane is an open-source project management tool. In versions…6.5
Are you affected by CVE-2026-40096?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST