Fish Island Backend CVE-2026-111720

No special conditions beyond network reachability - the GET /api/web/parse endpoint is exposed without authentication (PR:N) and the CorsConfig reference suggests broad cross-origin exposure, so default deployments reachable from the attacker's network are vulnerable. Exploitation specifically requires that the server can route to the targeted internal/loopback/metadata address; impact is LIMITED to data reflected through the parser (page title, meta description, favicon), so blind SSRF against services that return none of these yields little direct read-back. Real-world severity escalates only where the deployment runs in a cloud environment exposing an unauthenticated metadata endpoint (e.g., 169.254.169.254) or hosts internal HTTP services that leak sensitive titles/metadata.

This is a genuine but modest-severity SSRF (CWE-918) whose signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network-reachable, low-complexity, unauthenticated exploitation with no user interaction, matching the description of an open GET /api/web/parse endpoint. However, the impact metrics (VC:L/VI:N/VA:N, no subsequent-system impact) cap the real-world severity: the attacker only reads back page titles, meta descriptions, and favicons, so this is an information-exposure / internal-reconnaissance primitive, not a path to code execution or full data theft. There is no CISA KEV listing and no EPSS score was provided, and no public exploit code is referenced (only a HackMD technical write-up and a VulnCheck advisory), so active exploitation should not be assumed. The practical priority is driven less by the limited data returned and more by the blast radius: unauthenticated SSRF that can reach cloud metadata endpoints (e.g., 169.254.169.254) can escalate to credential theft depending on the hosting environment, which is why the 6.9 base score likely understates environment-specific risk. Key missing data: no EPSS probability and no vendor patch/fixed-commit are available to confirm remediation status.

A remote, unauthenticated attacker sends a crafted GET request to /api/web/parse with a url parameter pointing at an internal service or cloud metadata endpoint. Because the server uses redirect-following OkHttp requests, the attacker can pivot to loopback or internal hosts and read back the fetched page's title, meta description, and favicon, enabling internal network reconnaissance or metadata exposure. No public exploit code is identified, though a detailed technical write-up (HackMD) and VulnCheck advisory describe the flaw, and the low attack complexity (AC:L) makes manual exploitation trivial.