immich: Open Redirect via Shared Album name_CVE-2026-40096

5.1 / 10

MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Description

immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open redirect vulnerability in the shared album functionality, where the album name is inserted unsanitized into a <meta> tag in api.service.ts. A registered attacker can create a shared album with a crafted name containing 0;url=https://attackersite.com" http-equiv="refresh, which when rendered in the <meta property="og:title"> tag causes the victim's browser to redirect to an attacker-controlled site upon opening the share link. This facilitates phishing attacks, as the attacker could host a modified version of immich that collects login credentials from victims who believe they need to authenticate to view the shared album. This issue has been fixed in version 2.7.3.

Basic Information

ID CVE-2026-40096

Source GitHub_M

Published Apr 14, 2026 at 23:54

Affected Product

Vendor immich-app

Product immich

Version < 2.7.3

Affected Versions immich-app immich < 2.7.3

CWE Classification

CWE-79 CWE-601

References

{
    "lastseen": "",
    "description": "immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open redirect vulnerability in the shared album functionality, where the album name is inserted unsanitized into a <meta> tag in api.service.ts. A registered attacker can create a shared album with a crafted name containing 0;url=https://attackersite.com\" http-equiv=\"refresh, which when rendered in the <meta property=\"og:title\"> tag causes the victim's browser to redirect to an attacker-controlled site upon opening the share link. This facilitates phishing attacks, as the attacker could host a modified version of immich that collects login credentials from victims who believe they need to authenticate to view the shared album. This issue has been fixed in version 2.7.3.",
    "published": "2026-04-14T23:54:17.662Z",
    "modified": "2026-04-14T23:54:17.662Z",
    "type": "cve",
    "title": "immich: Open Redirect via Shared Album name",
    "source": "GitHub_M",
    "references": "https://github.com/immich-app/immich/security/advisories/GHSA-24fq-72x8-v7hm\nhttps://github.com/immich-app/immich/releases/tag/v2.7.3",
    "id": "CVE-2026-40096",
    "bulletinFamily": "",
    "cwe": [
        "CWE-79",
        "CWE-601"
    ],
    "cvelist": null,
    "sourceData": "immich-app immich < 2.7.3",
    "sourceHref": "",
    "cvss": {
        "score": 5.1,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "immich",
    "version": "< 2.7.3",
    "vendor": "immich-app",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}