ArcReel CVE-2026-121581

Exploitation requires an authenticated session with sufficient privilege to call the Provider Test-Connection feature at /api/v1/providers/{id}/test (PR:L) - it is not unauthenticated. Given that account requirement, the attacker then supplies a manipulated destination so the server performs a request on their behalf (classic SSRF, CWE-918). Impact is limited to low confidentiality (VC:L, e.g. reaching/reading internal services); there is no integrity or availability impact and no scope/subsequent-system change. The specific parameter or field that controls the request target is not described in the available sources. The main limiting factors are the authentication requirement and the restriction to low-sensitivity disclosure, which together cap realistic impact below the raw network-vector score.

This is a moderate-severity, authenticated SSRF (CVSS 4.0 base 5.3) whose real-world urgency is tempered on nearly every signal. The vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N describes a network-reachable but privilege-requiring (PR:L) flaw with only low confidentiality impact and no integrity or availability impact, and no subsequent-system (scope) impact. The embedded E:P maturity flag indicates proof-of-concept-level exploit maturity rather than active exploitation. No EPSS score and no KEV listing were provided in the input, so there is no evidence of active exploitation or high predicted exploitation probability; the only exploit signal is a public PoC reference that is not verified as working exploit code. The vuln.today decision label is 'this_month', i.e. scheduled remediation rather than act_now/emergency. Weighing these together: this is a legitimate but second-tier issue - a genuine SSRF that an authenticated user can abuse, not a drop-everything emergency. The two notable aggravating facts are that the vendor was contacted and did not respond (no coordinated fix timeline) and that the CVSS was authored by VulDB rather than the vendor, so metric values are third-party assessments and not vendor-confirmed.

An authenticated ArcReel user (PR:L) invokes the Provider Test-Connection endpoint /api/v1/providers/{id}/test and supplies an attacker-chosen destination, causing the server to issue requests to internal or otherwise unreachable hosts and return limited response data (VC:L). A public PoC reference exists but is not verified as working exploit code, so a working weaponized exploit is not confirmed; the precise manipulation that triggers the request is not detailed in the available sources beyond identifying the test-connection endpoint.