CVE-2026-25118

Katalog CVE

CVSS 7.5 · High EPSS 0,45%

Kerentanan Use of HTTP Request With Sensitive Query String pada futo immich. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable to credential disclosure when a user authenticates to a shared album. During the authentication process, the application transmits the album password within the URL query parameters in a GET request to /api/shared-links/me. This exposes the password in browser history, proxy and server logs, and referrer headers, allowing unintended disclosure of authentication credentials. The impact of this vulnerability is the potential compromise of shared album access and unauthorized exposure of sensitive user data. This issue has been patched in version 2.6.0.

Rincian

Terbit di NVD

3 April 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-598: Use of HTTP Request With Sensitive Query String

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/immich-app/immich/security/advisories/GHSA-78x4-6x83-jx75 exploit · mitigasi · advisory vendor
• https://github.com/immich-app/immich/pull/26868 issue tracking · patch
• https://github.com/immich-app/immich/pull/26886 issue tracking · patch
• https://github.com/immich-app/immich/releases/tag/v2.6.0 product · release notes