CVE-2026-40096

immich: Open Redirect via Shared Album name

Published Apr 14, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Description

immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open redirect vulnerability in the shared album functionality, where the album name is inserted unsanitized into a <meta> tag in api.service.ts. A registered attacker can create a shared album with a crafted name containing 0;url=https://attackersite.com" http-equiv="refresh, which when rendered in the <meta property="og:title"> tag causes the victim's browser to redirect to an attacker-controlled site upon opening the share link. This facilitates phishing attacks, as the attacker could host a modified version of immich that collects login credentials from victims who believe they need to authenticate to view the shared album. This issue has been fixed in version 2.7.3.

Analysis

Technical impact

The vulnerability allows a registered attacker to create a shared album whose name contains a crafted meta tag that triggers a browser redirect to an arbitrary URL. When a victim opens the share link, the unsanitized album name is inserted into an og:title meta tag, causing the victim’s browser to navigate to the attacker‑controlled site. The attacker can then present a counterfeit version of immich to harvest credentials, enabling phishing attacks.

Affected Systems

This flaw exists in the immich self‑hosted photo and video management solution, specifically in all versions before 2.7.3 of immich-app:immich. No post‑2.7.3 releases are affected.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate risk; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack requires the victim to open a crafted shared album link, an action that can be achieved via email or messaging. The attacker’s ability to create such a link is limited to registered users, but once the link is exposed, victims can be redirected without authentication prompts, facilitating phishing and credential theft.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

immich-app

immich

affected

Version	Status	Constraints
`< 2.7.3`	affected	—

Configuration 1 [-]

cpe:2.3:a:futo:immich:*:*:*:*:*:docker:*:*

No data.

Vendor Product Versions

Immich-app

Immich

Version	Status	Scheme	Platform
`[0,2.7.3)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest immich update (v2.7.3 or later) to eliminate the open redirect flaw.
Avoid clicking on shared album links from unknown or untrusted senders until the vulnerability is patched.
Implement input validation or sanitization for album names to neutralize meta tag injection if patching is delayed.

Generated by OpenCVE AI on April 15, 2026 at 01:20 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.209% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/immich-app/immich/releases/tag/v2.7.3
https://github.com/immich-app/immich/security/advisories/GHSA-24fq-72x8-v7hm

History

Apr 23, 2026 3:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Futo Futo immich
CPEs		cpe:2.3:a:futo:immich::::::docker::*
Vendors & Products		Futo Futo immich
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}`

Apr 15, 2026 5:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 15, 2026 2:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Immich-app Immich-app immich
Vendors & Products		Immich-app Immich-app immich

Apr 15, 2026 12:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open redirect vulnerability in the shared album functionality, where the album name is inserted unsanitized into a <meta> tag in api.service.ts. A registered attacker can create a shared album with a crafted name containing 0;url=https://attackersite.com" http-equiv="refresh, which when rendered in the <meta property="og:title"> tag causes the victim's browser to redirect to an attacker-controlled site upon opening the share link. This facilitates phishing attacks, as the attacker could host a modified version of immich that collects login credentials from victims who believe they need to authenticate to view the shared album. This issue has been fixed in version 2.7.3.
Title		immich: Open Redirect via Shared Album name
Weaknesses		CWE-601 CWE-79
References		https://github.com/immich-app/immich/releases/tag/v2.7.3 https://github.com/immich-app/immich/security/advisories/GHSA-24fq-72x8-v7hm
Metrics		cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}`

Subscriptions

Futo Immich

Immich-app Immich

Weaknesses

CWE-601
URL Redirection to Untrusted Site ('Open Redirect')
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')