CVE-2026-72598
Received Received - Intake

Server-Side Request Forgery in Apioo Fusio

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax via FILTER_VALIDATE_URL but applies no IP or host denylist. When the registered event fires, the server issues an HTTP POST to the attacker-supplied internal URL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72598
EUVD
EUVD-2026-56037

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apioo fusio 8.8.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a server-side request forgery (SSRF) vulnerability in Apioo Fusio 8.8.3. Authenticated users with a consumer role can register a webhook URL pointing to an internal network address. The server then makes HTTP requests to that internal URL when the registered event triggers. The vulnerability exists because the URL validation does not check for internal or restricted hosts.

Detection Guidance

To detect this SSRF vulnerability in Apioo Fusio 8.8.3, monitor outbound HTTP requests from the Fusio server to internal network addresses. Check webhook registration logs for URLs pointing to private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8). Inspect server logs for POST requests to unexpected internal hosts during event triggers.

Impact Analysis

An attacker could exploit this to force the server to send requests to internal systems, potentially accessing sensitive data or services. This could lead to unauthorized information disclosure, internal network scanning, or further attacks against internal infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's security requirements for protecting sensitive health information. Compliance may be impacted if internal systems or data are accessed without authorization.

Mitigation Strategies

Immediately update Apioo Fusio to the latest version that patches this vulnerability. If an update is not available, restrict webhook registration to trusted external URLs and implement IP/host denylists to block internal network access. Monitor network traffic for unusual POST requests to internal addresses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72598. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart