What is the CVSS score of CVE-2026-72591?

CVE-2026-72591 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Koito are affected by CVE-2026-72591?

Koito versions through 0.3.2 contain a server-side request forgery vulnerability in the album image endpoint that allows authenticated users to coerce the application server into issuing arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-72591?

Within 24 hours: Immediately disable or restrict access to the album image endpoint in production environments; audit user permissions and revoke unnecessary application access. Within 7 days: Conduct a complete inventory of Koito deployments (v0.3.2 and earlier), map network access from each instance, and assess exposure to sensitive internal systems; deploy network controls to restrict outbound HTTP/HTTPS from Koito servers to authorized hosts only. Within 30 days: Implement compensating controls including Web Application Firewall rules to detect and block SSRF patterns on image endpoints; establish request logging for album image operations; plan migration to Koito v0.3.3 or later once vendor patch availability is confirmed, and test thoroughly before deployment.

Koito CVE-2026-72591

EUVD-2026-55215 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-10 TuranSec

GHSA-hwrh-8qfp-c4p6

SSRF Koito

7.7

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network-reachable SSRF requiring a low-privilege session; scope changes as server pivots to internal hosts; no integrity or availability impact from information-disclosure-only SSRF.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 10, 2026 - 12:17 EUVD

Analysis Generated

Aug 10, 2026 - 11:26 vuln.today

CVE Published

Aug 10, 2026 - 10:41 cve.org

HIGH 7.7

DescriptionCVE.org

A server-side request forgery (SSRF) vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted image_url value in the PATCH /apis/web/v1/album/{id}/image endpoint. The application fetches the supplied URL server-side without validating the destination host or blocking access to private, loopback, link-local, or internal addresses.

AnalysisAI

Server-side request forgery in gabehf/Koito through v0.3.2 lets authenticated users coerce the application server into issuing arbitrary HTTP requests to internal or external hosts via the album image endpoint. The CVSS scope-change rating (S:C) reflects that exploitation reaches beyond the vulnerable component itself - an attacker can pivot through the server to probe cloud metadata services, internal APIs, or RFC-1918 hosts unreachable directly from the internet. No public exploit or active exploitation is identified at time of analysis, but the low attack complexity and lack of URL validation make this straightforward to abuse once authenticated.

Technical ContextAI

CWE-918 (Server-Side Request Forgery) arises when an application accepts a URL from user input and fetches it server-side without validating the destination against an allowlist or blocking reserved address ranges (RFC-1918 private, 127.x.x.x loopback, 169.254.x.x link-local/cloud-metadata). The vulnerable surface is the PATCH /apis/web/v1/album/{id}/image REST endpoint, which accepts an image_url parameter and performs an outbound HTTP fetch without host-restriction controls. Affected product is cpe:2.3:a:gabehf:koito:*:*:*:*:*:*:*:* through v0.3.2, as confirmed by NVD CPE. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N reflects that the fetch operation crosses trust boundaries (scope change) and can expose high-confidentiality internal data.

RemediationAI

No vendor-released patch version has been identified at time of analysis - the only reference points to the upstream GitHub repository at https://github.com/gabehf/Koito, and no tagged fix release was confirmed. Operators should monitor that repository for a remediation commit or release. As immediate compensating controls: restrict outbound HTTP from the Koito application server using firewall egress rules to only permitted image CDN hostnames (trade-off: breaks arbitrary external image fetching by design); implement an application-layer SSRF filter that rejects URLs resolving to RFC-1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and link-local (169.254.0.0/16) before the HTTP request is issued; or temporarily disable the album image URL fetch feature entirely until a patch is available. Cloud-hosted deployments should additionally apply IMDSv2 enforcement on AWS (requiring a session token for metadata access) to limit the value of SSRF-reachable metadata endpoints, though this does not eliminate the underlying flaw.