Friendica CVE-2026-72597

Exploitation requires the attacker to hold a valid authenticated session on the target Friendica instance (CVSS PR:L), which on most public nodes is achievable via free self-registration - no administrator approval or elevated role is required. The link-preview feature must be accessible to authenticated users, which is default behavior. No additional configuration, plugin, or non-default setting is required beyond the standard installation. Exploitation is limited by: (1) the authenticated requirement - unauthenticated visitors cannot trigger the SSRF; (2) instances that disable open registration narrow the attacker pool to invited or existing users; (3) egress firewall rules that block RFC-1918 and link-local destinations would prevent internal network probing even if the endpoint remains accessible; (4) scope is unchanged (S:U), meaning the attacker cannot directly pivot to other systems through Friendica's process - they can only read responses the Friendica server itself receives.

The CVSS 3.1 base score of 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N is internally consistent and well-calibrated for this class of SSRF. The network attack vector and low attack complexity are accurate - exploitation requires only an HTTP request from any internet-accessible machine. The low-privilege requirement (PR:L) is the primary limiting factor, but on public Friendica nodes this is effectively neutralized by open self-registration, reducing the realistic barrier to near-zero. The high confidentiality impact (C:H) is justified given the potential to harvest cloud metadata credentials, which can escalate to full cloud account compromise. No EPSS score was provided in the source data; without it, exploitation probability cannot be quantified numerically. The vulnerability is not listed in the CISA KEV catalog, and no POC code has been identified, placing exploitation likelihood in the speculative category. However, the attack pattern is trivially replicable by any attacker familiar with SSRF - no custom tooling is required. The absence of a KEV listing should not be interpreted as low risk; rather, this is a high-real-world-risk issue specifically on cloud-hosted, publicly-registered Friendica instances.

An attacker registers a free account on a publicly accessible, cloud-hosted Friendica instance and submits a crafted URL such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ to the link-preview endpoint. The Friendica server fetches the URL from its own network context, and the cloud metadata service responds with temporary IAM credentials, which are returned to or observable by the attacker. The attacker then uses these credentials to authenticate to the cloud provider's API and escalate to broader infrastructure access.