CVE-2026-72597
Received Received - Intake

Server-Side Request Forgery in Friendica

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny list. An attacker can use this to scan the internal network or access cloud metadata services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72597
EUVD
EUVD-2026-56036

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
friendica friendica *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a server-side request forgery (SSRF) vulnerability in Friendica through the 2026.08-dev branch. It allows authenticated users with a self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without checking an internal IP deny list.

Detection Guidance

Check Friendica logs for unusual requests to internal IP addresses or cloud metadata services via the link-preview endpoint. Monitor network traffic for outbound connections from the Friendica server to unexpected destinations.

Impact Analysis

An attacker could use this to scan your internal network or access cloud metadata services. This could expose sensitive internal services or data to unauthorized users.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing internal network services to unauthorized access. The SSRF flaw allows attackers to probe internal systems, which may lead to unauthorized data access or disclosure, violating confidentiality requirements under these regulations.

Mitigation Strategies

Update Friendica to a patched version if available. Apply an internal IP deny list to the link-preview endpoint to block access to private or cloud metadata addresses. Restrict self-registered user permissions to limit their ability to trigger the endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72597. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart