Read the docs
TI-2026-28923 Aliases CVE-2026-40096

immich: Open Redirect via Shared Album name

Priority MEDIUM 56CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Spoofing, Cross-site scripting
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-601 and CWE-79.

Summary

immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open redirect vulnerability in the shared album functionality, where the album name is inserted unsanitized into a <meta> tag in api.service.ts. A registered attacker can create a shared album with a crafted name containing 0;url=https://attackersite.com" http-equiv="refresh, which when rendered in the <meta property="og:title"> tag causes the victim's browser to redirect to an attacker-controlled site upon opening the share link. This facilitates phishing attacks, as the attacker could host a modified version of immich that collects login credentials from victims who believe they need to authenticate to view the shared album. This issue has been fixed in version 2.7.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00206 10th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed immich (immich-app): 2.7.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
immich-appimmichbefore 2.7.32.7.3Patch availableCNA
  • immich Vendorimmich-app Affected before 2.7.3 Fixed in 2.7.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:futo:immich:*:*:*:*:*:docker:*:*before 2.7.3Vulnerableimmich-app
  • cpe:2.3:a:futo:immich:*:*:*:*:*:docker:*:* Versions before 2.7.3 Vulnerable ·immich-app

Remediation

  • Fix · CNA immich (immich-app) Fixed in 2.7.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40096

References

Exploit 1

Other 1

  • TI-2026-19252 immich API Key Privilege Escalation vulnerability CVSS 3.1HIGH 8.8
  • TI-2026-20281 immich-server: Insecure Transmission of Authentication Credentials via Password Parameter… CVSS 4.0MEDIUM 6.3
  • TI-2026-27586 immich has Stored XSS via OCR Text in 360° Panorama Viewer CVSS 3.1HIGH 7.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences