Sencho CVE-2026-108523

Requires a valid authenticated session with access to the git-sources Browse API endpoint (CVSS PR:L; the vendor characterizes this as a privileged administrative function), plus the ability to control the repo_url argument processed in outboundTarget.ts. On pre-patch builds the server would resolve and connect to attacker-supplied internal targets including loopback, link-local, multicast, cloud-metadata and other special-use addresses, and would follow redirects and inherited proxy routing. Limiting factors: exploitation is NOT possible unauthenticated - the attacker must already possess credentials privileged enough to configure git sources; impact is limited to Low confidentiality (internal request issuance/response exposure) with no integrity or availability impact; and the vendor disputes that reaching private networks constitutes a boundary bypass since that reach is an intentional, documented feature.

Signals are mixed and lean toward moderate, targeted risk rather than a widespread emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack but explicitly requires privileges (PR:L) - so this is an authenticated SSRF, not an unauthenticated internet-facing bug, and confidentiality impact is only Low (VC:L) with no integrity or availability impact. A public exploit exists (VulDB gist) and the vector carries E:P (proof-of-concept), but there is no CISA KEV listing and no EPSS score was supplied, so there is no evidence of active or automated exploitation. Crucially, the vendor formally disputes the CVE, arguing that git-repository access is an intentional privileged administrative function that is designed to reach private LAN/VPC/VPN/CGNAT/IPv6-ULA targets, and that no privilege-boundary bypass by an unprivileged user was demonstrated - this directly conflicts with treating the behavior as a vulnerability and should be verified. The description itself states 'the presence of this vulnerability remains uncertain at this time,' reinforcing low confidence. Net: a legitimate defense-in-depth hardening target (the vendor shipped SSRF guards), but for most defenders this is a lower-priority, authenticated, low-impact issue rather than a critical exposure.

An attacker who already holds low-privilege (operator/admin) credentials on a Sencho instance calls the git-sources Browse API endpoint and supplies a repo_url pointing at an internal address (e.g., a cloud metadata endpoint, loopback, or an internal-only service). The server dereferences the URL and issues an outbound request on the attacker's behalf, potentially returning internal data. A public proof-of-concept exists (VulDB gist), and the attack is performable remotely, but it is gated behind valid authentication.