EUVD-2026-56036
GHSA-mhpc-8ghx-95cq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable endpoint, low complexity; PR:L because a free authenticated account suffices; C:H for potential credential exfiltration via cloud metadata; no integrity or availability impact.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
1DescriptionCVE.org
A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny list. An attacker can use this to scan the internal network or access cloud metadata services.
AnalysisAI
Server-side request forgery in Friendica through the 2026.08-dev branch exposes internal network infrastructure to any authenticated user, including those with a free self-registered account. The link-preview endpoint fetches attacker-supplied URLs without enforcing an internal IP deny list, enabling enumeration of internal services and access to cloud instance metadata endpoints such as the AWS IMDSv1 endpoint at 169.254.169.254. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a valid authenticated session on the target Friendica instance (CVSS PR:L), which on most public nodes is achievable via free self-registration - no administrator approval or elevated role is required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N is internally consistent and well-calibrated for this class of SSRF. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version has been independently confirmed at time of analysis - the only reference provided is the upstream GitHub repository at https://github.com/friendica/friendica, which should be monitored for a fix commit or tagged release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Insecure Permissions vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information and e
Module/Settings/UserExport.php in Friendica through 2021.01 allows settings/userexport to be used by anonymous users, as
Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via t
Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via t
Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via t
Cross Site Scripting (XSS) vulnerability in Friendica versions after v.2023.12, allows a remote attacker to execute arbi
Unauthenticated SQL injection in Friendica (through the 2026.08-dev branch) lets remote attackers inject arbitrary SQL t
Friendica 2024.03 is vulnerable to Cross Site Scripting (XSS) in settings/profile via the homepage, xmpp, and matrix par
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today