Nextcloud News CVE-2026-44515

Exploitation requires a valid, authenticated Nextcloud account with at least low-level privileges (PR:L per CVSS 4.0 vector) and the Nextcloud News application must be installed and accessible to that user. The attacker submits a maliciously crafted feed URL via the News web interface or its API endpoint, causing the server-side feed fetcher to issue HTTP requests to attacker-chosen destinations. The SSRF is strictly blind - HTTP response bodies and headers are not returned to the submitting user, which limits exploitation to port probing and service existence checks rather than data exfiltration. High attack complexity (AC:H) indicates conditions that may impede reliable exploitation, though the specific complexity factors are not enumerated in the advisory. Exploitation is not possible by unauthenticated users. No code execution, privilege escalation, or direct data access on the Nextcloud server results from this vulnerability.

The aggregate risk posture is low. CVSS 4.0 scores this at 2.3, driven primarily by the absence of any direct confidentiality or integrity impact on the vulnerable component (VC:N/VI:N/VA:N) and only marginal subsequent system impact (SC:L/SI:L). The high attack complexity (AC:H) further suppresses the score, suggesting exploitation is not straightforward even for authenticated users. EPSS at 0.04% (12th percentile) confirms that empirically observed exploitation activity is negligible. SSVC corroborates: Exploitation rated 'none', Automatable rated 'no', Technical Impact rated 'partial' - consistent with a manual, non-scalable reconnaissance technique. There is no CISA KEV listing and no identified public exploit code. The primary real-world threat is internal network mapping by a malicious insider or a compromised low-privilege Nextcloud account - a meaningful but narrow threat model, especially for multi-tenant or enterprise Nextcloud deployments where the server has broad internal network reachability. The blind nature of the SSRF (no response relay) materially limits its utility compared to reflected SSRF variants.

An authenticated Nextcloud user with a low-privilege account submits a feed URL such as http://192.168.1.254/status or http://169.254.169.254/latest/meta-data/ through the News app interface or REST API. The Nextcloud server attempts to fetch the URL, resulting in an outbound HTTP request to the internal address. While no response content is returned to the attacker, repeated requests with varying IP:port combinations - interpreted via timing differences or Nextcloud-side error states - allow the attacker to map reachable internal services and identify open ports on hosts that are otherwise unreachable from the external network. No public exploit code has been identified at time of analysis.