VoceChat Server CVE-2026-100893

Requires that the VoceChat OpenGraph link-preview functionality (the open_graphic_parse endpoint backed by open_graph::fetch) is reachable and enabled - this is a default feature used to render link previews in chat, so no special non-default configuration is indicated. No authentication and no user interaction are needed per the CVSS vector (PR:N/UI:N), and the attack is network-remote against VoceChat Server builds up to and including 0.5.36. The practical limit on impact is that this is a link-preview fetcher: severity depends on whether the deployment exposes reachable internal services or a cloud metadata endpoint from the server's network position, and on whether fetch responses/errors leak content back to the attacker (blind vs non-blind), which is not confirmed in the source data.

This is a real but moderate-priority SSRF. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated, low-complexity exploitation with no user interaction, which raises baseline concern; however, the impact metrics are all Low (VC:L/VI:L/VA:L, SC/SI/SA:N), reflecting that this is a bounded server-side request forgery in a link-preview feature rather than RCE or full data compromise. Exploitation signals are mixed: publicly available exploit code exists (VulDB + is.yuum.me writeup, E:P 'Proof-of-Concept'), but there is NO EPSS score and NO CISA KEV listing provided, so there is no evidence of active or widespread exploitation - treat POC availability and active exploitation as distinct. The SSVC-style read is: exploitation=PoC, automatable likely yes (a simple URL-parameter manipulation), technical impact=partial. Net: a genuine, easily-triggered SSRF worth patching, but the low-impact scoring and niche product footprint keep it below critical/urgent. Key caveat: the description does not specify whether the SSRF is blind or reflects response content, so the true confidentiality reach (e.g., cloud metadata/internal service disclosure) is unverified - confirm against the PoC writeup before assuming metadata theft.

A remote unauthenticated attacker sends a request to the VoceChat OpenGraph link-preview endpoint (open_graphic_parse) supplying a crafted 'url' argument pointing at an internal service, loopback address, or cloud metadata endpoint (e.g., 169.254.169.254). The server's open_graph::fetch dutifully issues the outbound request, letting the attacker probe internal infrastructure or coerce the server into contacting attacker-controlled destinations. A public proof-of-concept and technical writeup already exist, lowering the bar to opportunistic exploitation.