What is the CVSS score of CVE-2026-50888?

CVE-2026-50888 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Koillection are affected by CVE-2026-50888?

Koillection 1.8.0 contains a server-side request forgery vulnerability permitting any authenticated user to probe and access internal network resources normally unreachable from the internet.. A patch is available.

How to fix or mitigate CVE-2026-50888?

Within 24 hours: Identify all Koillection 1.8.0 instances in production and non-production environments, then audit access logs and scraper feature activity from the past 60 days for suspicious URL submissions targeting private IP ranges or internal systems. Within 7 days: Configure network egress controls via firewall rules and security groups to restrict Koillection's outbound connections to whitelisted external domains only, explicitly blocking RFC 1918 private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata services; simultaneously deploy Web Application Firewall rules to reject requests destined for localhost, 127.0.0.1, or internal hostnames. Within 30 days: Request a security update timeline from the vendor or evaluate alternative scraper solutions, conduct forensic analysis of logs for exploitation indicators, and consider disabling the custom scraper feature if operationally non-critical.

Koillection CVE-2026-50888

EUVD-2026-36786 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-15 mitre

GHSA-gmxh-hjfv-qc2w

SSRF N A

8.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.1 HIGH

Any authenticated user (PR:L) can trigger it remotely with no interaction; SSRF primarily discloses internal data (C:H) with limited integrity effect (I:L), so I downgrade I from the vendor's H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 16:57 vuln.today

CVE Published

Jun 15, 2026 - 00:00 cve.org

HIGH 8.1

CVE Published

Jun 15, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An authenticated Server-Side Request Forgery (SSRF) in the custom scraper subsystem component of Benjamin Jonard Koillection v1.8.0 allows attackers to scan internal resources via supplying a crafted URL.

AnalysisAI

Server-Side Request Forgery in Koillection 1.8.0's custom scraper subsystem lets an authenticated user supply a crafted URL that the application fetches server-side, enabling reconnaissance and access to internal-only resources otherwise unreachable from the internet. The CVSS vector requires low privileges (PR:L), so an ordinary logged-in account is sufficient, and the flaw yields high confidentiality and integrity impact (C:H/I:H). Publicly available exploit code exists via a referenced gist, though there is no public exploit identified as being used in active attacks and EPSS probability is low at 0.15%.

Technical ContextAI

Koillection is an open-source, self-hosted PHP/Symfony application for managing personal collections. The affected component is its custom scraper subsystem, a feature that retrieves and parses remote web pages (typically to auto-populate item metadata) from a user-provided URL. The root cause is CWE-918 (Server-Side Request Forgery): the scraper issues an outbound HTTP request to attacker-controlled input without adequately validating or restricting the destination, so the server can be coerced into contacting arbitrary internal hosts, ports, and cloud metadata endpoints. Because the request originates from the server, it bypasses network perimeter controls and reaches resources that the attacker's own client could not.

RemediationAI

No vendor-released patch version is identified at time of analysis - the provided data contains no fixed release, and the CPE/EUVD version fields are placeholders, so a specific upgrade target cannot be cited. Monitor the upstream Koillection GitHub repository and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-50888) for a patched release and upgrade as soon as one is published. As compensating controls until then: disable or restrict the custom scraper feature if your deployment does not require it, which removes the outbound-fetch attack surface at the cost of losing metadata auto-population; place the Koillection server behind an egress firewall or forward proxy that denies requests to RFC1918/link-local ranges and to the cloud metadata endpoint 169.254.169.254, accepting that this may break legitimate scraping of internal-hosted resources; and tighten account provisioning since exploitation requires an authenticated user, so limiting who can register or hold accounts reduces the pool of potential attackers.