EUVD-2026-56036
GHSA-mhpc-8ghx-95cq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable endpoint, low complexity; PR:L because a free authenticated account suffices; C:H for potential credential exfiltration via cloud metadata; no integrity or availability impact.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
1DescriptionCVE.org
A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny list. An attacker can use this to scan the internal network or access cloud metadata services.
AnalysisAI
Server-side request forgery in Friendica through the 2026.08-dev branch exposes internal network infrastructure to any authenticated user, including those with a free self-registered account. The link-preview endpoint fetches attacker-supplied URLs without enforcing an internal IP deny list, enabling enumeration of internal services and access to cloud instance metadata endpoints such as the AWS IMDSv1 endpoint at 169.254.169.254. No public exploit code has been identified at time of analysis, but the low privilege barrier - a free self-registered account - significantly broadens the realistic attacker pool on public Friendica instances.
Technical ContextAI
Friendica is an open-source federated social networking platform (CPE: cpe:2.3:a:friendica:friendica:*:*:*:*:*:*:*:*) that implements ActivityPub and Diaspora protocols and is typically self-hosted. The vulnerable component is a link-preview feature that performs server-side HTTP fetching of user-supplied URLs to generate rich link previews. CWE-918 (Server-Side Request Forgery) describes the root cause: the application acts as an HTTP proxy on behalf of the user without validating whether the destination is an internal or loopback address. The absence of a deny list for RFC-1918 address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and link-local ranges (169.254.0.0/16) means the server's own network context is exposed to any authenticated requester. Cloud-hosted instances are particularly at risk because metadata services are reachable at predictable link-local addresses and return credentials or instance configuration without authentication.
RemediationAI
No vendor-released patched version has been independently confirmed at time of analysis - the only reference provided is the upstream GitHub repository at https://github.com/friendica/friendica, which should be monitored for a fix commit or tagged release. Administrators should implement a server-level egress firewall rule or application-layer deny list that blocks outbound HTTP/HTTPS requests from the Friendica process to RFC-1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and the link-local range (169.254.0.0/16); this prevents metadata service access and internal network scanning while leaving external link previews functional, with the trade-off that any legitimate internal URLs would also be blocked. On AWS, enabling IMDSv2 (requiring a session-oriented PUT request) adds a second layer of defense since the SSRF via a simple GET cannot obtain IMDSv2 tokens. If link-preview functionality is non-essential, disabling it entirely at the Friendica configuration level eliminates the attack surface without side effects on core federation features. Restricting new user self-registration on public instances raises the effective privilege bar and reduces the attacker pool while a patch is pending.
Insecure Permissions vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information and e
Module/Settings/UserExport.php in Friendica through 2021.01 allows settings/userexport to be used by anonymous users, as
Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via t
Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via t
Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via t
Cross Site Scripting (XSS) vulnerability in Friendica versions after v.2023.12, allows a remote attacker to execute arbi
Unauthenticated SQL injection in Friendica (through the 2026.08-dev branch) lets remote attackers inject arbitrary SQL t
Friendica 2024.03 is vulnerable to Cross Site Scripting (XSS) in settings/profile via the homepage, xmpp, and matrix par
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today