CVE-2026-72598
MediumCVSS 6.5Summary
Server-side request forgery vulnerability in Apioo Fusio 8.8.3. Authenticated consumer-role users can make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The URL validation does not block IPs or hostnames.
Risk Assessment
An attacker can use the server to scan the internal network or access internal services, potentially leading to security compromise.
Recommendation
Update Fusio to a fixed version. Implement a denylist of IPs and hosts for webhooks.
Original NVD description (English source)
A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax via FILTER_VALIDATE_URL but applies no IP or host denylist. When the registered event fires, the server issues an HTTP POST to the attacker-supplied internal URL.