Weoll CVE-2026-77112

Exploitation requires the Weoll application to expose a server-side URL-fetching or resource-retrieval feature and, per the CVSS vector (UI:R), depends on a user being induced to trigger the crafted request rather than fully autonomous attacker action. The vector lists PR:N (no privileges), implying the affected function is reachable without authentication, though for a collaboration platform this is worth verifying with the vendor. Impact is limited to confidentiality (C:H, I:N, A:N) with no scope change (S:U), so the flaw enables reading internal/back-end responses but does not itself grant modification or service disruption. Only Weoll versions before 3.2.45.44 are affected; upgrading to 3.2.45.44 or later removes exposure.

This is a moderate-priority issue, not a top-tier emergency. The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects a network-reachable, low-complexity SSRF with confidentiality-only impact and no integrity or availability effect. Two signals meaningfully temper the raw score: UI:R means a victim must be induced to act (e.g., submit or trigger a crafted URL), and there is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis - so there is no evidence of active or imminent exploitation. A conflict worth verifying: the vector claims PR:N (unauthenticated) and S:U, yet Weoll is a workplace/collaboration platform where URL-fetching features typically sit behind login; PR:N is plausible but debatable and should be confirmed with the vendor, as should the C:H rating, which assumes SSRF can read sensitive internal responses (cloud metadata, internal services) rather than just cause blind requests. Overall: a real, patchable SSRF worth remediating on a normal cycle, but not a drop-everything item absent exploitation evidence.

An attacker crafts a malicious URL and induces an authenticated or targeted Weoll user to trigger a server-side fetch (the UI:R requirement), causing the Weoll backend to issue attacker-controlled requests to internal systems or cloud metadata endpoints. The server's responses can expose internal-only data (C:H), enabling reconnaissance of the internal network or theft of credentials/metadata. No public proof-of-concept exploit has been identified at time of analysis.