Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Untriaged
Permalink CVE-2026-25118
created 1 week, 4 days ago
immich-server: Insecure Transmission of Authentication Credentials via Password Parameter in HTTP Request Query String When Accessing Shared Albums

immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable to credential disclosure when a user authenticates to a shared album. During the authentication process, the application transmits the album password within the URL query parameters in a GET request to /api/shared-links/me. This exposes the password in browser history, proxy and server logs, and referrer headers, allowing unintended disclosure of authentication credentials. The impact of this vulnerability is the potential compromise of shared album access and unauthorized exposure of sensitive user data. This issue has been patched in version 2.6.0.

Affected products

immich
  • ==< 2.6.0

Matching in nixpkgs

pkgs.immich

Self-hosted photo and video backup solution

pkgs.immich-cli

Self-hosted photo and video backup solution (command line interface)

pkgs.immichframe

Display your photos from Immich as a digital photo frame

  • nixos-unstable -
    • nixpkgs-unstable
    • nixos-unstable-small

pkgs.immich-kiosk

Lightweight slideshow for running on kiosk devices and browsers that uses Immich as a data source

pkgs.gnomeExtensions.immich-wallpaper

Sets desktop wallpaper from Immich server photos

  • nixos-unstable 9
    • nixpkgs-unstable 9
    • nixos-unstable-small 9
  • nixos-25.11 4
    • nixos-25.11-small 4
    • nixpkgs-25.11-darwin 4

Package maintainers