Benotes
Monthly
Server-side request forgery in the self-hosted bookmark manager Benotes (fr0tt benotes) through version 2.8.1 allows an authenticated, low-privileged user to make the server fetch an arbitrary URL they control through the bookmark metadata endpoint. Exploitation requires a valid account with access to the bookmark creation/metadata flow (CVSS PR:L) and only affects confidentiality at a low level, with no integrity, availability, or cross-system scope impact assessed; the overall severity is low (CVSS 4.0 score 2.1). A public PoC reference exists but is not verified as working exploit code, there is no CISA KEV listing, and the maintainer was notified via a GitHub issue but has not responded, so no vendor fix is currently identified.
Server-side request forgery in the self-hosted bookmark manager Benotes (fr0tt benotes) through version 2.8.1 allows an authenticated, low-privileged user to make the server fetch an arbitrary URL they control through the bookmark metadata endpoint. Exploitation requires a valid account with access to the bookmark creation/metadata flow (CVSS PR:L) and only affects confidentiality at a low level, with no integrity, availability, or cross-system scope impact assessed; the overall severity is low (CVSS 4.0 score 2.1). A public PoC reference exists but is not verified as working exploit code, there is no CISA KEV listing, and the maintainer was notified via a GitHub issue but has not responded, so no vendor fix is currently identified.