EUVD-2026-71947
GHSA-vfc8-q896-v58j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network reachable by authenticated workflow authors (PR:L); scope changes as internal-only endpoints are accessed (S:C); both confidentiality and integrity impacted by internal API access.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP blocks to reach internal-only endpoints like POST /api/function/execute.
AnalysisAI
Confused deputy SSRF bypass in Sim before 0.8.14 allows authenticated workflow authors to reach internal-only API endpoints by exploiting URL prefix matching without scheme normalization. When an HTTP block in a workflow specifies a path beginning with /api/, the routing layer misclassifies the request as internal, skips SSRF validation, and mints an internal authentication token - granting the attacker access to endpoints such as POST /api/function/execute that are meant to be restricted to the server itself. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold an authenticated session with workflow authoring permissions in Sim Studio - specifically the ability to create or edit workflows and configure HTTP blocks with arbitrary URL paths. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N) scores 5.3, reflecting a limited-impact, network-reachable vulnerability requiring low privileges. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Sim Studio to version 0.8.14 or later; the fix is tracked in GitHub PR #7179 (https://github.com/simstudioai/sim/pull/7179), which implements proper scheme normalization and SSRF validation before classifying a URL as internal. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today