CVE-2026-40096

BRIEFING NOTE - CVE-2026-40096 OVERVIEW Immich versions prior to 2.7.3 contain an open redirect vulnerability in the shared album functionality. The vulnerability exists because album names are inserted unsanitized into meta tags within api.service.ts. An attacker with valid user credentials can create a malicious shared album with a crafted name designed to inject a meta refresh tag, redirecting victims to attacker-controlled sites when they access the share link. SEVERITY The vulnerability carries a CVSS v3.1 score of 5.4 (MEDIUM) with a network attack vector, low attack complexity, and low privilege requirements. User interaction is necessary for exploitation, as victims must click the shared album link. The attack could result in confidentiality and integrity impacts, as attackers could host credential-harvesting phishing pages mimicking the legitimate Immich interface to compromise user accounts. The attack scope is changed, potentially affecting other systems. EXPLOITATION STATUS The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, and there is no evidence of active exploitation in the wild. The EPSS score of 0.00048 is significantly lower than the baseline, indicating minimal probability of exploitation. The vulnerability remains on inactive status in community tracking systems, suggesting limited public attention or weaponized exploit code availability. Organizations running Immich should prioritize updating to version 2.7.3 to remediate this risk.