Immich CVE-2026-25118

While the CVSS score of 6.3 reflects moderate severity, the real-world risk is elevated by the passive nature of exploitation. The CVSS vector indicates network-accessible attack surface (AV:N), low attack complexity (AC:L), and no privileges required (PR:N), but the AT:P (Preparatory/Time-of-Interaction) modifier indicates the attacker must time their interception or log access with password transmission events. The vulnerability does not require active interaction beyond normal user behavior (UI:N, though AT:P suggests state-dependent attack timing). The vulnerability's impact is limited to confidentiality (VC:L), with no integrity or availability impact, and containment to the service itself (SC:N). The primary exploitation path requires either: (1) access to server logs or reverse proxy logs (administrative capability), (2) access to user browser history (local/compromised system), (3) monitoring HTTP traffic, or (4) exploiting referrer header leakage to external sites. This is not CISA KEV-listed active exploitation, and no public exploit code exists-this is a configuration/implementation flaw requiring log access or man-in-the-middle position. For organizations with strong log retention controls and HTTPS-enforced environments, real-world risk is lower; for those with permissive log access or HTTP-proxied traffic, risk is substantially higher. The patch availability (v2.6.0 released) and straightforward remediation mitigate urgency.

An attacker with administrative access to an Immich deployment's reverse proxy or application server logs extracts shared album passwords from logged GET requests to /api/shared-links/me, then uses those credentials to access password-protected shared albums without further authorization. Alternatively, a user's browser history or a compromised HTTP client (such as a monitoring tool or logging proxy) exposes the password query parameter, allowing the attacker to reconstruct authentication requests and gain unauthorized album access. A third scenario involves an HTTP-based redirect or XSS on an external website that causes the Immich user's browser to send a referrer header containing the album password in cleartext. No public exploit code is required; exploitation is passive log review or traffic inspection.