SocialEngine CVE-2026-41461

Q: What is the CVSS score of CVE-2026-41461?

CVE-2026-41461 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25226 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-23 VulnCheck

SSRF Socialengine

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.4 MEDIUM

Network-accessible via authenticated HTTP request (AV:N, PR:L); scope changes as server proxies to internal systems (S:C); C:L and I:L reflect limited blind enumeration and potential interaction with internal services.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 23, 2026 - 15:00 euvd

EUVD-2026-25226

Analysis Generated

Apr 23, 2026 - 15:00 vuln.today

CVE Published

Apr 23, 2026 - 13:45 nvd

MEDIUM 6.3

DescriptionCVE.org

SocialEngine versions 7.8.0 and prior contain a blind server-side request forgery vulnerability in the /core/link/preview endpoint where user-supplied input passed via the uri request parameter is not sanitized before being used to construct outbound HTTP requests. Authenticated remote attackers can supply arbitrary URLs including internal network addresses and loopback addresses to cause the server to issue HTTP requests to attacker-controlled destinations, enabling internal network enumeration and access to services not intended to be externally reachable.

AnalysisAI

Blind server-side request forgery in SocialEngine 7.8.0 and prior allows authenticated remote attackers to weaponize the server as an HTTP proxy against internal infrastructure via the /core/link/preview endpoint's unsanitized uri parameter. The vulnerability enables internal network enumeration, discovery of non-externally-reachable services, and potential access to cloud metadata endpoints such as AWS IMDSv1. EPSS is very low at 0.04% (11th percentile) with no active exploitation identified (not in CISA KEV, SSVC exploitation=none), but the CVSS 4.0 subsequent-system confidentiality score of High signals meaningful lateral risk in cloud-hosted or network-rich deployments.

Technical ContextAI

SocialEngine is a PHP-based commercial social networking platform. The affected feature is a link preview function exposed at /core/link/preview, a standard social platform capability that fetches URL metadata (title, description, thumbnail) on behalf of users. The root cause is CWE-918 (Server-Side Request Forgery): user-supplied input in the uri POST/GET parameter is passed directly to an outbound HTTP client without URL validation, allowlisting, or scheme restriction. The 'blind' qualifier means HTTP response bodies are not reflected to the attacker - exploitation relies on side-channel inference (timing, error codes, DNS callbacks) rather than direct data exfiltration. The CPE string cpe:2.3:a:socialengine:socialengine:*:*:*:*:*:*:*:* with version range 0 through 7.8.0 (per EUVD-2026-25226) confirms all prior releases are affected. The CVSS 4.0 vector's SC:H metric reflects that the real damage is to subsequent systems the server can reach - internal APIs, databases, and cloud metadata services - rather than SocialEngine itself.

RemediationAI

No specific patched version has been identified in any available reference at time of analysis - upgrade to a SocialEngine release beyond 7.8.0 once the vendor (https://socialengine.com) publishes a fix. Until a patch is available, the highest-value compensating control is network-level egress filtering on the web server host: block outbound HTTP/HTTPS to RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and cloud metadata addresses (169.254.169.254) - this prevents the most dangerous pivot scenarios with minimal impact to legitimate link preview functionality for external URLs. A secondary control is implementing a URL allowlist in a web application firewall or reverse proxy that restricts the uri parameter to known-safe external domains, though this may break user-submitted link previews for arbitrary sites. If the link preview feature is not business-critical, restricting or disabling access to the /core/link/preview endpoint entirely eliminates the attack surface with no functional impact on other features. See the researcher disclosure at https://karmainsecurity.com/KIS-2026-07 for technical detail to inform patching prioritization.