CVE-2026-108521
MediumCVSS 4.7Summary
A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1 affecting the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the Add Remote Node API Endpoint component. Manipulation leads to server-side request forgery, and the attack can be executed remotely. The exploit has been disclosed to the public and may be used; the vendor confirms that the node API URL could be configured by an authenticated user with node-management permission.
Risk Assessment
An authenticated user with node-management permission can force the server to make requests to internal resources, potentially leading to interaction with internal services, though the vendor states arbitrary internal response exfiltration was not demonstrated.
Recommendation
Restrict node-management permissions to trusted administrators only and deploy a fix validating node URLs to prevent requests to internal resources.
Other vulnerabilities in Studio-Saelix Sencho
See all- CVE-2026-108523Medium
A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1 affecting unknown code of the file outboundTarget.ts of the git-sources Browse API Endpoint component. Manipulation of the repo_url argument can lead to server-side request forgery, and the attack may be performed remotely. The exploit has been publicly disclosed and may be utilized; the patch is named 79b86ddcd4aefdd6941f098e35990ab397b13c72.
- CVE-2026-108522High
A vulnerability was found in Studio-Saelix Sencho up to 0.94.1 affecting the file /api/auth/login of the Login Endpoint component. Manipulation of the X-Forwarded-For argument results in improper authentication, and the attack can be carried out remotely. The exploit has been made public and could be used; the patch is named 79b86ddcd4aefdd6941f098e35990ab397b13c72.
Original NVD description (English source)
A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The node API URL could be configured by an authenticated user with node-management permission and used to initiate server-side requests. [T]he report demonstrates server-side request capability but not arbitrary internal response exfiltration."
Vulnerability data from NVD (NIST) · CISA KEV · EPSS