CVE-2026-48053
Received Received - Intake

Open Redirect Vulnerability in Kolibri Education Platform

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description
Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated `baseurl` parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints on the `RemoteFacilityUser*` viewsets; remediation review found two further reflection points on the same pattern. The GET endpoint was unauthenticated. Version 0.19.4 fixes the vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-48053
EUVD
EUVD-2026-60319

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
learningequality kolibri to 0.19.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-48053 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the Kolibri education platform. It affects multiple API endpoints that accept an unvalidated baseurl parameter, allowing attackers to force the Kolibri server to make HTTP requests to arbitrary internal or external hosts. The server then reflects the response body back to the caller.

Detection Guidance

To detect this SSRF vulnerability, monitor network traffic for outbound HTTP requests from the Kolibri server to unexpected or internal hosts. Check logs for API endpoints using the baseurl parameter, especially /api/auth/remotefacilityuser, /api/auth/remotefacilityauthenticateduserinfo, /api/public/setupwizard/loddata, and /api/public/networklocation/<id>/facilities/. Use tools like tcpdump or Wireshark to capture requests originating from the Kolibri server.

Impact Analysis

This vulnerability can be exploited to exfiltrate data from internal services, access cloud metadata endpoints (like AWS IMDSv1), or scan internal networks. It requires no privileges or user interaction and can be used for internal network reconnaissance or data theft.

Compliance Impact

This SSRF vulnerability could lead to unauthorized data access or exfiltration, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected Kolibri versions may face compliance violations due to potential data breaches.

Mitigation Strategies

Immediately upgrade Kolibri to version 0.19.4 or later to patch the vulnerability. If upgrading is not possible, restrict access to affected API endpoints by implementing authentication and input validation for the baseurl parameter. Block outbound requests to private or loopback addresses and cloud metadata endpoints. Monitor network traffic for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48053. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart