CVE-2026-25118

The record

immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable to credential disclosure when a user authenticates to a shared album. During the authentication process, the application transmits the album password within the URL query parameters in a GET request to /api/shared-links/me. This exposes the password in browser history, proxy and server logs, and referrer headers, allowing unintended disclosure of authentication credentials. The impact of this vulnerability is the potential compromise of shared album access and unauthorized exposure of sensitive user data. This issue has been patched in version 2.6.0.

Affected packages

Related vulnerabilities

• CVE-2026-61614 SolidInvoice is an open-source invoicing platform. CWE-598
• CVE-2026-82181 Medical Practice Management System developed by Le-yan has a Sensitive Data in URL… CWE-598
• CVE-2026-76179 An improper protection of authentication tokens vulnerability exists in certain Ebyte… CWE-598
• CVE-2026-63408 Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your… CWE-598
• CVE-2026-66832 When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the… CWE-598
• CVE-2026-14838 Use of GET request method with sensitive query strings vulnerability in Bilin Software… CWE-598
• CVE-2026-54652 Frigate is an open source network video recorder. CWE-598
• CVE-2026-58656 Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query… CWE-598