Studio-Saelix Sencho CVE-2026-108521

Exploitation requires an authenticated account holding node-management permission and use of the Add Remote Node API endpoint, where a URL supplied to the isValidRemoteUrl function (backend/src/utils/validation.ts) bypasses validation to initiate server-side requests. Limiting factors: the attacker must already be authenticated and privileged (PR:H), so this is not reachable by anonymous remote users; impact is further constrained because, per the vendor, the flaw demonstrates server-side request capability but not arbitrary internal response exfiltration. Affected versions are Sencho up to and including 0.97.1.

This is a genuinely low-priority issue despite being an SSRF (CWE-918), and the signals are consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L) and base score of 2.0 both point to low real-world risk: exploitation requires PR:H - an authenticated user already holding node-management permission - which sharply limits the attacker population to trusted/privileged accounts. The E:P (Proof-of-Concept) exploit maturity aligns with the confirmed publicly available POC (gist by jovair1994), but a POC is not active exploitation; there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of widespread or automated exploitation. Impact is explicitly bounded: the vendor states the report demonstrates server-side request capability but NOT arbitrary internal response exfiltration, which is why confidentiality/integrity/availability are each only Low. In short, this is a low-CVSS, low-real-risk, privilege-gated SSRF - not a priority for emergency patching, though it should be fixed in normal cycles given a public POC exists.

An authenticated user with node-management permission uses the Add Remote Node API endpoint to supply a crafted URL that fails the isValidRemoteUrl validation in backend/src/utils/validation.ts, causing the server to issue requests to attacker-chosen internal or external destinations. A public proof-of-concept exists, but per the vendor the flaw yields server-side request capability (e.g., internal port/service probing or SSRF-based interactions) rather than exfiltration of internal response bodies.