CVE-2026-40096
mediumpriority · track · 22EPSS 0.002 · 11 %ileEUUSEPSS · scored 2026-10-27
immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open redirect vulnerability in the shared album functionality, where the album name is inserted unsanitized into a <meta> tag in api.service.ts. A registered attacker can create a shared album with a crafted name containing 0;url=https://attackersite.com" http-equiv="refresh, which when rendered in the <meta property="og:title"> tag causes the victim's browser to redirect to an attacker-controlled site upon opening the share link. This facilitates phishing attacks, as the attacker could host a modified version of immich that collects login credentials from victims who believe they need to authenticate to view the shared album. This issue has been fixed in version 2.7.3.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 1.2–5.4
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (6)
External citations — patches, advisories, analysis.
- https://immich.app/Patchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2026-40096cnnvd
- https://github.com/immich-app/immich/releases/tag/v2.7.3enisa_euvd
- https://github.com/immich-app/immich/security/advisories/GHSA-24fq-72x8-v7hmenisa_euvd
- https://github.com/immich-app/immich/releases/tag/v2.7.3ProductRelease Notesnvd
- https://github.com/immich-app/immich/security/advisories/GHSA-24fq-72x8-v7hmExploitVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan