Unauthenticated user can access main app screen after cancelling share flow. Mobile.

[PeterOmbodi]

I have searched the existing issues, both open and closed, to make sure this is not a duplicate report.

• Yes

The bug

Description

If a user who is not logged into the app attempts to share an asset to Immich (via the system share sheet), the app opens on the Share screen as expected.

However, if the user presses the Back button on that screen, the main application screen is displayed, allowing access to the timeline and other sections of the app - even though the user is not authenticated.

This bypasses the expected login flow.

Expected behavior

One of the following should happen:

• The user must authenticate before being allowed to proceed with the share flow;
  or
• After pressing Back, the app should either return to the previous app (close Immich).

In any case, the main application UI must not be accessible without authentication.

Actual behavior

Pressing Back opens the main application screen, even though the user is not authenticated.

The OS that Immich Server is running on

MacOS

Version of Immich Server

2.5.0

Version of Immich Mobile App

2.5.6

Platform with the issue

• Server
• Web
• Mobile

Reproduction steps

1. Ensure the user is logged out of the Immich mobile app.
2. From another app (e.g., File manager), share an asset and select Immich.
3. The Immich Share screen opens.
4. Press the Back button.
5. Observe that the main app screen (timeline, navigation, etc.) becomes accessible.

Additional information

Platform

• Android

Additional context

Video attached.

Screen_recording_20260211_151200.mp4