Vulnerability Description
immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open redirect vulnerability in the shared album functionality, where the album name is inserted unsanitized into a <meta> tag in api.service.ts. A registered attacker can create a shared album with a crafted name containing 0;url=https://attackersite.com" http-equiv="refresh, which when rendered in the <meta property="og:title"> tag causes the victim's browser to redirect to an attacker-controlled site upon opening the share link. This facilitates phishing attacks, as the attacker could host a modified version of immich that collects login credentials from victims who believe they need to authenticate to view the shared album. This issue has been fixed in version 2.7.3.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Futo | Immich | < 2.7.3 |
Related Weaknesses (CWE)
References
- https://github.com/immich-app/immich/releases/tag/v2.7.3ProductRelease Notes
- https://github.com/immich-app/immich/security/advisories/GHSA-24fq-72x8-v7hmExploitVendor Advisory
FAQ
What is CVE-2026-40096?
CVE-2026-40096 is a vulnerability with a CVSS score of 5.4 (MEDIUM). immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open redirect vulnerability in the shared album functionality, where the album name is ...
How severe is CVE-2026-40096?
CVE-2026-40096 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-40096?
Check the references section above for vendor advisories and patch information. Affected products include: Futo Immich.