CVE-2026-46382

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46382", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-13T19:53:47.922Z", "datePublished": "2026-08-12T23:39:50.870Z", "dateUpdated": "2026-08-13T17:53:05.546Z"}, "containers": {"cna": {"title": "Meeting Room Booking System has server-side request forgery in import functionality", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/meeting-room-booking-system/mrbs-code/security/advisories/GHSA-gh77-mpcm-f8r3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/meeting-room-booking-system/mrbs-code/security/advisories/GHSA-gh77-mpcm-f8r3"}, {"name": "https://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.12.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.12.2"}], "affected": [{"vendor": "meeting-room-booking-system", "product": "mrbs-code", "versions": [{"version": "< 1.12.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-12T23:39:50.870Z"}, "descriptions": [{"lang": "en", "value": "The Meeting Room Booking System (MRBS) is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available."}], "source": {"advisory": "GHSA-gh77-mpcm-f8r3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T17:49:11.755739Z", "id": "CVE-2026-46382", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T17:53:05.546Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Meeting Room Booking System has server-side request forgery in import functionality", "source": {"advisory": "GHSA-gh77-mpcm-f8r3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "meeting-room-booking-system", "product": "mrbs-code", "versions": [{"status": "affected", "version": "< 1.12.2"}]}], "references": [{"url": "https://github.com/meeting-room-booking-system/mrbs-code/security/advisories/GHSA-gh77-mpcm-f8r3", "name": "https://github.com/meeting-room-booking-system/mrbs-code/security/advisories/GHSA-gh77-mpcm-f8r3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.12.2", "name": "https://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.12.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "The Meeting Room Booking System (MRBS) is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-12T23:39:50.870Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46382", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T17:49:11.755739Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-08-13T17:49:13.178Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-46382", "state": "PUBLISHED", "dateUpdated": "2026-08-12T23:39:50.870Z", "dateReserved": "2026-05-13T19:53:47.922Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-12T23:39:50.870Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mrbs-code", "vendor": "meeting-room-booking-system", "versions": [{"status": "affected", "version": "< 1.12.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Meeting Room Booking System (MRBS) is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available."}, {"lang": "es", "value": "El Sistema de Reserva de Salas de Reuniones (MRBS) es una aplicaci\u00f3n basada en PHP para reservar salas de reuniones. Antes de la versi\u00f3n 1.12.2, una URI privada/local proporcionada por el usuario pod\u00eda ser obtenida sin verificaciones. La versi\u00f3n 1.12.2 contiene una correcci\u00f3n. No se conocen soluciones alternativas disponibles."}], "id": "CVE-2026-46382", "lastModified": "2026-10-23T19:10:00.167", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46382", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T17:49:11.755739Z", "version": "2.0.3"}}]}, "published": "2026-08-13T00:17:32.090", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.12.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/meeting-room-booking-system/mrbs-code/security/advisories/GHSA-gh77-mpcm-f8r3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "mrbs: Meeting Room Booking System: Server-Side Request Forgery in import functionality", "id": "2515026", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515026"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-918", "details": ["A flaw was found in the Meeting Room Booking System (MRBS). This vulnerability, known as Server-Side Request Forgery (SSRF), allows a remote attacker to trick the server into making requests to internal or local network resources. By exploiting this, an attacker could potentially gain unauthorized access to sensitive information or perform actions on behalf of the server."], "mitigation": {"lang": "en:us", "value": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.\nVersion 1.12.2 contains the fix."}, "name": "CVE-2026-46382", "public_date": "2026-08-12T23:39:50Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-46382\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46382\nhttps://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.12.2\nhttps://github.com/meeting-room-booking-system/mrbs-code/security/advisories/GHSA-gh77-mpcm-f8r3"], "statement": "This Important flaw in the Meeting Room Booking System (MRBS) import functionality allows a remote attacker to perform Server-Side Request Forgery (SSRF). This enables the server to fetch private or local network URIs without proper validation, potentially leading to unauthorized information disclosure or access to internal network services. The impact is elevated due to the potential for internal network reconnaissance and interaction.\nThis component is shipped only in Fedora.\nRed Hat does not ship this component in any core Red Hat products.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.12.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "mrbs-code", "source": "cna", "vendor": "meeting-room-booking-system"}, "product": "mrbs-code", "vendor": "meeting-room-booking-system"}], "created": "2026-08-13T02:15:02.663152+00:00", "updated": "2026-08-13T09:47:25.221748+00:00", "vendors": ["meeting-room-booking-system", "meeting-room-booking-system$PRODUCT$mrbs-code"]}