Helium Platform CVE-2026-55875

Requires an authenticated Helium account (PR:L) able to call POST /feed/externalcalendars/ and store an external calendar URL; no special product feature toggle is needed because the vulnerable code path (validate_url checking only syntax, then urllib.request.urlopen in icalexternalcalendarservice.py) is the default external-calendar behavior. Exploitation is amplified by fetch_ical_conditional, which periodically refetches the stored URL, giving repeatable server-side requests. The primary limiting factor is the authentication requirement - the attacker must be a registered/valid user of the target instance; impact is further limited to outbound request forgery and internal reconnaissance (host/port reachability) rather than confirmed data exfiltration, per the advisory.

This is a moderate-severity, authenticated SSRF (CWE-918) with a vendor-aligned CVSS of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The signals are internally consistent and point to a real-but-limited issue rather than an emergency. The attack vector is network and complexity is low, but PR:L means a valid authenticated account is required, which meaningfully constrains the attacker population to registered users of a given Helium instance. The impact is scoped to confidentiality-low (C:L): the advisory itself is explicit that it demonstrates only forced outbound requests and internal host/port reconnaissance (via distinct responses and an uncaught http.client.RemoteDisconnected for non-HTTP services), and deliberately does NOT claim secret retrieval because the ECS credentials path is task-specific and unpredictable. No KEV listing and no public exploit code are indicated in the input, so exploitation status is 'no public exploit identified at time of analysis'. EPSS is not provided, so exploitation probability cannot be quantified from this data. SSVC inputs (exploitation/automatable/technical impact) were not supplied. Net: treat as a routine-priority patch - genuine SSRF reachable by any authenticated user, but low technical impact and no evidence of active exploitation or weaponization.

An attacker who has registered or compromised any Helium user account submits a crafted URL (e.g. http://169.254.169.254/ or an internal host:port) to POST /feed/externalcalendars/; because validate_url only checks syntax, the server fetches it via urllib.request.urlopen and periodically re-fetches it. By observing differential responses and the RemoteDisconnected error on non-HTTP ports, the attacker maps internal services and reachable hosts behind the application. No public exploit code is identified at time of analysis.