CVE-2026-40096
immich: Open Redirect via Shared Album name
immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open redirect vulnerability in the shared album functionality, where the album name is inserted unsanitized into a <meta> tag in api.service.ts. A registered attacker can create a shared album with a crafted name containing 0;url=https://attackersite.com" http-equiv="refresh, which when rendered in the <meta property="og:title"> tag causes the victim's browser to redirect to an attacker-controlled site upon opening the share link. This facilitates phishing attacks, as the attacker could host a modified version of immich that collects login credentials from victims who believe they need to authenticate to view the shared album. This issue has been fixed in version 2.7.3.
| CWE | CWE-79 CWE-601 |
| Vendor | immich-app |
| Product | immich |
| Published | Apr 14, 2026 |
| Last Updated | Apr 15, 2026 |
Get instant alerts for immich-app immich
Be the first to know when new unknown vulnerabilities affecting immich-app immich are published — delivered to Slack, Telegram or Discord.