CVE-2026-28508

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28508", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-27T20:57:47.709Z", "datePublished": "2026-03-06T04:13:19.621Z", "dateUpdated": "2026-03-06T16:07:56.001Z"}, "containers": {"cna": {"title": "Idno: Unauthenticated SSRF via URL Unfurl Endpoint", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.2, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/idno/idno/security/advisories/GHSA-fcrh-fqxh-6fx6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/idno/idno/security/advisories/GHSA-fcrh-fqxh-6fx6"}, {"name": "https://github.com/idno/idno/releases/tag/1.6.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/idno/idno/releases/tag/1.6.4"}], "affected": [{"vendor": "idno", "product": "idno", "versions": [{"version": "< 1.6.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T04:13:19.621Z"}, "descriptions": [{"lang": "en", "value": "Idno is a social publishing platform. Prior to version 1.6.4, a logic error in the API authentication flow causes the CSRF protection on the URL unfurl service endpoint to be trivially bypassed by any unauthenticated remote attacker. Combined with the absence of a login requirement on the endpoint itself, this allows an attacker to force the server to make arbitrary outbound HTTP requests to any host, including internal network addresses and cloud instance metadata services, and retrieve the response content. This issue has been patched in version 1.6.4."}], "source": {"advisory": "GHSA-fcrh-fqxh-6fx6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-06T16:00:20.241576Z", "id": "CVE-2026-28508", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T16:07:56.001Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28508", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-06T16:00:20.241576Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T16:00:21.792Z"}}], "cna": {"title": "Idno: Unauthenticated SSRF via URL Unfurl Endpoint", "source": {"advisory": "GHSA-fcrh-fqxh-6fx6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.2, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "idno", "product": "idno", "versions": [{"status": "affected", "version": "< 1.6.4"}]}], "references": [{"url": "https://github.com/idno/idno/security/advisories/GHSA-fcrh-fqxh-6fx6", "name": "https://github.com/idno/idno/security/advisories/GHSA-fcrh-fqxh-6fx6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/idno/idno/releases/tag/1.6.4", "name": "https://github.com/idno/idno/releases/tag/1.6.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Idno is a social publishing platform. Prior to version 1.6.4, a logic error in the API authentication flow causes the CSRF protection on the URL unfurl service endpoint to be trivially bypassed by any unauthenticated remote attacker. Combined with the absence of a login requirement on the endpoint itself, this allows an attacker to force the server to make arbitrary outbound HTTP requests to any host, including internal network addresses and cloud instance metadata services, and retrieve the response content. This issue has been patched in version 1.6.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T04:13:19.621Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28508", "state": "PUBLISHED", "dateUpdated": "2026-03-06T16:07:56.001Z", "dateReserved": "2026-02-27T20:57:47.709Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-06T04:13:19.621Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "idno", "vendor": "idno", "versions": [{"status": "affected", "version": "< 1.6.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:withknown:known:*:*:*:*:*:*:*:*", "matchCriteriaId": "03C6A2FD-591E-4396-B7DF-AFE37782951B", "versionEndExcluding": "1.6.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Idno is a social publishing platform. Prior to version 1.6.4, a logic error in the API authentication flow causes the CSRF protection on the URL unfurl service endpoint to be trivially bypassed by any unauthenticated remote attacker. Combined with the absence of a login requirement on the endpoint itself, this allows an attacker to force the server to make arbitrary outbound HTTP requests to any host, including internal network addresses and cloud instance metadata services, and retrieve the response content. This issue has been patched in version 1.6.4."}, {"lang": "es", "value": "Idno es una plataforma de publicaci\u00f3n social. Antes de la versi\u00f3n 1.6.4, un error l\u00f3gico en el flujo de autenticaci\u00f3n de la API provoca que la protecci\u00f3n CSRF en el endpoint del servicio de expansi\u00f3n de URL sea trivialmente eludida por cualquier atacante remoto no autenticado. Combinado con la ausencia de un requisito de inicio de sesi\u00f3n en el propio endpoint, esto permite a un atacante forzar al servidor a realizar solicitudes HTTP salientes arbitrarias a cualquier host, incluyendo direcciones de red internas y servicios de metadatos de instancias en la nube, y recuperar el contenido de la respuesta. Este problema ha sido parcheado en la versi\u00f3n 1.6.4."}], "id": "CVE-2026-28508", "lastModified": "2026-06-17T10:28:45.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28508", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-06T16:00:20.241576Z", "version": "2.0.3"}}]}, "published": "2026-03-06T05:16:35.233", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/idno/idno/releases/tag/1.6.4"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/idno/idno/security/advisories/GHSA-fcrh-fqxh-6fx6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.6.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "idno", "vendor": "idno"}], "analysis": {"en": {"generated_at": "2026-04-16T11:39:46.119986+00:00", "value": {"mitigation_remediation": ["Upgrade Idno to version 1.6.4 or later, which removes the authentication bypass and enforces authentication on the unfurl endpoint.", "If an upgrade cannot be applied immediately, restrict access to the unfurl endpoint with firewall rules or network segmentation so that only trusted hosts can reach it.", "Enable logging or network monitoring to detect unexpected outbound HTTP requests from the Idno server and configure alerts for potential SSRF activity."], "summary": {"action": "Immediate Patch", "impact": "Unauthenticated Server Side Request Forgery (SSRF) that can expose internal resources"}, "threat_synthesis": {"affected_systems": "Installations of the Idno social publishing platform running a version older than 1.6.4 are affected. The advisory indicates that any unpatched release before the 1.6.4 update is vulnerable, regardless of deployment size or environment.", "description_and_impact": "The vulnerability is a logic flaw in Idno\u2019s authentication flow that bypasses CSRF protection on a publicly accessible URL unfurl endpoint. Because the endpoint does not require login, any unauthenticated user can send a request to cause the server to fetch arbitrary URLs. The server then returns the retrieved content, allowing attackers to probe internal hosts, services, or cloud instance metadata. This is a classic Server Side Request Forgery flaw, classified as CWE\u2011918, and can lead to data exposure or internal reconnaissance.", "risk_and_exploitability": "The CVSS score of 9.2 signals a high severity, but the EPSS score of less than 1% indicates that exploitation is unlikely in the wild. The issue is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been observed. An attacker can trigger the SSRF simply by making an HTTP request to the unfurl endpoint without authentication; no additional conditions are required. However, because the flaw allows outbound requests to any URL reachable from the server, the potential impact is significant, especially if the server can reach sensitive internal services or cloud metadata endpoints."}}}}, "created": "2026-03-06T14:55:54.628663+00:00", "updated": "2026-04-16T11:45:26.266793+00:00", "vendors": ["idno", "idno$PRODUCT$idno"]}