CVE-2026-72597
MediumCVSS 6.5Summary
Server-side request forgery vulnerability in Friendica through the 2026.08-dev branch. Authenticated users with a free self-registered account can probe internal network services via the link-preview endpoint, which fetches any user-supplied URL without applying an internal IP deny list.
Risk Assessment
An attacker can scan the internal network or access cloud metadata services, potentially leading to information disclosure or further attacks.
Recommendation
Update Friendica to a fixed version. Apply an internal IP deny list to the link-preview endpoint.
Original NVD description (English source)
A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny list. An attacker can use this to scan the internal network or access cloud metadata services.