CVE-2026-48053

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48053", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-20T18:15:53.579Z", "datePublished": "2026-08-17T17:57:05.139Z", "dateUpdated": "2026-08-17T19:53:05.341Z"}, "containers": {"cna": {"title": "Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/learningequality/kolibri/security/advisories/GHSA-4mj9-pf4r-cqrc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/learningequality/kolibri/security/advisories/GHSA-4mj9-pf4r-cqrc"}, {"name": "https://github.com/learningequality/kolibri/releases/tag/v0.19.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/learningequality/kolibri/releases/tag/v0.19.4"}, {"name": "https://github.com/pypa/advisory-database/tree/main/vulns/kolibri/PYSEC-2026-2554.yaml", "tags": ["x_refsource_MISC"], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/kolibri/PYSEC-2026-2554.yaml"}], "affected": [{"vendor": "learningequality", "product": "kolibri", "versions": [{"version": "< 0.19.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-17T17:57:05.139Z"}, "descriptions": [{"lang": "en", "value": "Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated `baseurl` parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints on the `RemoteFacilityUser*` viewsets; remediation review found two further reflection points on the same pattern. The GET endpoint was unauthenticated. Version 0.19.4 fixes the vulnerability."}], "source": {"advisory": "GHSA-4mj9-pf4r-cqrc", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/learningequality/kolibri/security/advisories/GHSA-4mj9-pf4r-cqrc", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-17T19:52:57.370330Z", "id": "CVE-2026-48053", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-17T19:53:05.341Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48053", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-17T19:52:57.370330Z"}}}], "references": [{"url": "https://github.com/learningequality/kolibri/security/advisories/GHSA-4mj9-pf4r-cqrc", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-17T19:52:43.164Z"}}], "cna": {"title": "Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset", "source": {"advisory": "GHSA-4mj9-pf4r-cqrc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "learningequality", "product": "kolibri", "versions": [{"status": "affected", "version": "< 0.19.4"}]}], "references": [{"url": "https://github.com/learningequality/kolibri/security/advisories/GHSA-4mj9-pf4r-cqrc", "name": "https://github.com/learningequality/kolibri/security/advisories/GHSA-4mj9-pf4r-cqrc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/learningequality/kolibri/releases/tag/v0.19.4", "name": "https://github.com/learningequality/kolibri/releases/tag/v0.19.4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pypa/advisory-database/tree/main/vulns/kolibri/PYSEC-2026-2554.yaml", "name": "https://github.com/pypa/advisory-database/tree/main/vulns/kolibri/PYSEC-2026-2554.yaml", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated `baseurl` parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints on the `RemoteFacilityUser*` viewsets; remediation review found two further reflection points on the same pattern. The GET endpoint was unauthenticated. Version 0.19.4 fixes the vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-17T17:57:05.139Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48053", "state": "PUBLISHED", "dateUpdated": "2026-08-17T19:53:05.341Z", "dateReserved": "2026-05-20T18:15:53.579Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-17T17:57:05.139Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "kolibri", "vendor": "learningequality", "versions": [{"status": "affected", "version": "< 0.19.4"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated `baseurl` parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints on the `RemoteFacilityUser*` viewsets; remediation review found two further reflection points on the same pattern. The GET endpoint was unauthenticated. Version 0.19.4 fixes the vulnerability."}, {"lang": "es", "value": "Kolibri es una plataforma educativa con prioridad sin conexi\u00f3n. Antes de la versi\u00f3n 0.19.4, varios puntos finales de la API de Kolibri aceptan un par\u00e1metro \u2019baseurl\u2019 no validado y obtienen URL controladas por el atacante del servidor de Kolibri, reflejando el cuerpo de la respuesta de vuelta al llamador. El informe original identific\u00f3 dos puntos finales en los viewsets \u2019RemoteFacilityUser\u2019; la revisi\u00f3n de remediaci\u00f3n encontr\u00f3 dos puntos de reflexi\u00f3n adicionales en el mismo patr\u00f3n. El punto final GET no estaba autenticado. La versi\u00f3n 0.19.4 corrige la vulnerabilidad."}], "id": "CVE-2026-48053", "lastModified": "2026-10-23T16:10:00.313", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48053", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-17T19:52:57.370330Z", "version": "2.0.3"}}]}, "published": "2026-08-17T18:16:39.660", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/learningequality/kolibri/releases/tag/v0.19.4"}, {"source": "security-advisories@github.com", "url": "https://github.com/learningequality/kolibri/security/advisories/GHSA-4mj9-pf4r-cqrc"}, {"source": "security-advisories@github.com", "url": "https://github.com/pypa/advisory-database/tree/main/vulns/kolibri/PYSEC-2026-2554.yaml"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/learningequality/kolibri/security/advisories/GHSA-4mj9-pf4r-cqrc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.19.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "kolibri", "source": "cna", "vendor": "learningequality"}, "product": "kolibri", "vendor": "learningequality"}], "created": "2026-08-17T19:45:04.928333+00:00", "updated": "2026-08-21T12:39:50.587785+00:00", "vendors": ["learningequality", "learningequality$PRODUCT$kolibri"]}