Immich CVE-2026-40096

Exploitation requires three specific conditions: (1) the attacker must be a registered user of the target Immich instance with permission to create shared albums, (2) the victim must receive and actively click the crafted shared album link, and (3) the victim's browser must respect the injected meta refresh tag and redirect (which all modern browsers do by default). Default configurations of Immich allow any registered user to create and share albums, making this vulnerability exploitable without special setup. However, Immich instances with authentication disabled or shared album creation disabled are not affected, as are victims using browsers configured to block meta refresh redirects.

This vulnerability presents moderate real-world risk despite the low CVSS score of 5.1 and exceptionally low EPSS score of 0.04%. The CVSS vector correctly identifies mitigating factors: authentication is required (PR:L), and user interaction is necessary (UI:P), limiting the attack scope to registered users who must click a crafted share link. However, the practical impact is significant because (1) shared album links in photo management platforms are frequently clicked by non-technical users trusting the sender, (2) phishing success rates are typically high when the landing page impersonates a legitimate service, and (3) credential theft from a self-hosted photo platform could expose private media and potentially provide access to the underlying system. The very low EPSS percentile (13th) suggests minimal current exploitation, but this likely reflects the vulnerability's recent disclosure rather than genuine absence of exploitation risk. For Immich deployments handling sensitive family photos or business media, the attack chain requires only a single registered user and victim interaction, making this a practical priority despite CVSS and EPSS metrics suggesting otherwise. Organizations should treat this as a moderate-priority patch based on deployment sensitivity and user base composition, not on CVSS/EPSS scores alone.

A registered Immich user creates a shared album with the crafted name '0;url=https://attacker.com/fake-login" http-equiv="refresh'. When a victim receives the share link and opens it in their browser, the malicious name is rendered in the meta tag, triggering an automatic redirect to the attacker's phishing site. The attacker's site displays an Immich-like login form, and if the victim enters credentials, the attacker captures them for account compromise.