CVE-2026-72591
Received Received - Intake

SSRF in gabehf Koito through v0.3.2

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
A server-side request forgery (SSRF) vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted image_url value in the PATCH /apis/web/v1/album/{id}/image endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-72591
EUVD
EUVD-2026-55215

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gabehf koito 0.3.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a server-side request forgery (SSRF) vulnerability in the Koito application through version 0.3.2. An authenticated user can exploit it by sending a crafted image_url parameter to the PATCH /apis/web/v1/album/{id}/image endpoint. The server will then make HTTP requests to arbitrary internal or external hosts without validating the destination, potentially accessing private, loopback, link-local, or internal addresses.

Detection Guidance

To detect this SSRF vulnerability in Koito, monitor server logs for unusual outbound HTTP requests, especially to internal or unexpected external hosts. Check for requests to private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback addresses (127.0.0.1), or link-local addresses (169.254.0.0/16). Look for patterns in the PATCH /apis/web/v1/album/{id}/image endpoint with crafted image_url values.

Impact Analysis

An attacker could use this to access internal services, exfiltrate sensitive data, or perform unauthorized actions on behalf of the server. Since the vulnerability requires authentication, the impact depends on user privileges. It may also enable further attacks like port scanning or bypassing network restrictions.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using Koito may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately update Koito to the latest version beyond v0.3.2. If an update is unavailable, restrict access to the vulnerable endpoint via network policies or firewall rules. Disable or block requests to internal, private, loopback, and link-local addresses in the application's HTTP client configuration. Monitor and audit all outbound requests from the server.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72591. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart