# CVE-2026-25118: Immich credential disclosure in shared album authentication

Source: https://junglewise.ai/threats/cve-2026-25118-immich-credential-disclosure-in-shared-album-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-03. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-25118 · Severity: high · CVSS 7.5 · Published 2026-04-03

Immich, a self-hosted photo and video management platform, contains a security flaw in how it handles passwords for shared albums. When a user enters a password to view a shared album, the system sends that password as part of the web address (URL) rather than hiding it. This means the password could be recorded in browser history, server logs, or network security logs, potentially allowing unauthorized individuals to access private photos and videos.

Technologies: [Immich](https://junglewise.ai/threats/technologies/immich). Vendors: [Immich](https://junglewise.ai/threats/vendors/immich).

## Quick answers

**Is CVE-2026-25118 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25118 being exploited in the wild.

**How severe is CVE-2026-25118?** High severity, with a CVSS score of 7.5, published 3 April 2026.

**Which products and versions are affected?** Immich < 2.6.0.

**Is there a fix for CVE-2026-25118?** A patch was published on 2026-03-19: Version 2.6.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25118 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-25118?** Check whether you run Immich at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Immich prior to version 2.6.0 is vulnerable to CWE-598 (Use of GET Request Method with Sensitive Query Strings). When a user authenticates to a shared album, the application transmits the album password within the URL query parameters of a GET request to the `/api/shared-links/me` endpoint. Because query parameters are frequently logged by web servers, reverse proxies, and browser histories, this practice exposes sensitive credentials to anyone with access to those logs. An attacker who obtains these logs could gain unauthorized access to shared albums and the sensitive media contained within. The issue is resolved in version 2.6.0 by changing how authentication data is transmitted.

## Affected products

- immich-app Immich < 2.6.0

## Timeline

- 2026-04-02: advisory: Vendor security advisory published on GitHub
- 2026-04-03: disclosed: CVE-2026-25118 published to NVD
- 2026-03-19: patched: Version 2.6.0 released with fix

## References

- [https://github.com/immich-app/immich/pull/26868](https://github.com/immich-app/immich/pull/26868)
- [https://github.com/immich-app/immich/pull/26886](https://github.com/immich-app/immich/pull/26886)
- [https://github.com/immich-app/immich/releases/tag/v2.6.0](https://github.com/immich-app/immich/releases/tag/v2.6.0)
- [https://github.com/immich-app/immich/security/advisories/GHSA-78x4-6x83-jx75](https://github.com/immich-app/immich/security/advisories/GHSA-78x4-6x83-jx75)

## Related threats

- [Immich unauthorized album owner role modification](https://junglewise.ai/threats/cve-2026-77439-immich-is-a-self-hosted-photo-and-video-management-solution-prior)
- [Immich calendar heatmap unauthorized access vulnerability](https://junglewise.ai/threats/cve-2026-104867-immich-is-a-high-performance-self-hosted-photo-and-video)
- [Immich information disclosure in map markers API](https://junglewise.ai/threats/cve-2026-119329-immich-is-a-high-performance-self-hosted-photo-and-video)
- [Immich missing authorization in partner sync stream](https://junglewise.ai/threats/cve-2026-108165-immich-through-3-3-1-contains-a-missing-authorization)
- [Immich SVG upload to ImageMagick remote code execution](https://junglewise.ai/threats/cve-2026-105764-immich-is-a-high-performance-self-hosted-photo-and-video)