Wegow CVE-2026-101300

Requires an authenticated session with a promoter-level account (PR:L) and access to the ticket sales chart 'Download PDF' feature. The attacker must intercept and modify the <svg> parameter of the POST request that Wegow generates and sends to the export.highcharts.com service. Exploitation is limited by: (1) the need for valid promoter credentials - this is not unauthenticated; (2) reliance on the third-party Highcharts cloud export service as the request originator, so SSRF reach is constrained to whatever that external SaaS can reach rather than Wegow's internal network; and (3) the attacker controlling the fetched external resources, which positions the flaw primarily as request proxying/laundering. There is no indication the issue is limited to a non-default configuration; it appears inherent to the PDF export workflow.

CVSS 4.0 base score is 7.1 (High), driven almost entirely by VI:H while VC:N and VA:N - an unusual weighting for an SSRF, which more typically carries a confidentiality impact. The vector is AV:N/AC:L/AT:N/PR:L/UI:N, meaning network-reachable, low-complexity, no user interaction, but requiring an authenticated promoter account (PR:L). No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no signal of active or widespread exploitation. The real-world risk is tempered by three factors: (1) exploitation requires a valid promoter-level account, a meaningful access barrier; (2) the SSRF is not against Wegow's own infrastructure but abuses the third-party export.highcharts.com SaaS as the request intermediary, so there is no obvious path to pivot into Wegow internal network/metadata endpoints; and (3) the attacker already controls the 'external resources' being fetched, so the primary value is request laundering/proxying rather than internal data theft. CONFLICT TO VERIFY WITH VENDOR: the chosen VI:H (high integrity impact) is difficult to justify from the described behavior, which reads as a classic read-oriented SSRF via Highcharts export - the impact metrics appear overstated relative to the description. Overall this is a moderate, authenticated, bounded issue rather than a top-priority emergency.

An attacker who holds (or phishes/registers) a promoter account logs into Wegow, opens the ticket sales chart, and selects 'Download PDF', intercepting the resulting POST request. They tamper with the <svg> parameter so that export.highcharts.com fetches a URL they control, and the service's HTTP responses are embedded into the generated PDF, letting the attacker use the export service as a blind SSRF/proxy intermediary. No public exploit code is identified, and exploitation requires low-complexity but authenticated access.