CVE-2026-65967

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-65967", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-23T18:15:14.579Z", "datePublished": "2026-11-11T18:33:09.909Z", "dateUpdated": "2026-11-12T19:38:06.884Z"}, "containers": {"cna": {"title": "Fider: Server-Side Request Forgery (SSRF) via Webhook URL", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/getfider/fider/security/advisories/GHSA-g445-xwm7-594r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/getfider/fider/security/advisories/GHSA-g445-xwm7-594r"}, {"name": "https://github.com/getfider/fider/releases/tag/v0.34.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/getfider/fider/releases/tag/v0.34.0"}], "affected": [{"vendor": "getfider", "product": "fider", "versions": [{"version": "< 0.34.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-11T18:33:09.909Z"}, "descriptions": [{"lang": "en", "value": "Fider is a feedback portal for feature requests and suggestions. Prior to version 0.34.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Fider due to insufficient validation of webhook URLs. The application allows user-controlled URLs to be fetched by the server without restricting access to internal or external network resources. This enables attackers with administrative privileges to make arbitrary HTTP requests from the server, potentially accessing internal services or cloud metadata endpoints. This issue has been patched in version 0.34.0."}], "source": {"advisory": "GHSA-g445-xwm7-594r", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/getfider/fider/security/advisories/GHSA-g445-xwm7-594r", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-12T19:37:46.515516Z", "id": "CVE-2026-65967", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-12T19:38:06.884Z"}}]}}

{}

{"affected": [{"affectedData": [{"product": "fider", "vendor": "getfider", "versions": [{"status": "affected", "version": "< 0.34.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Fider is a feedback portal for feature requests and suggestions. Prior to version 0.34.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Fider due to insufficient validation of webhook URLs. The application allows user-controlled URLs to be fetched by the server without restricting access to internal or external network resources. This enables attackers with administrative privileges to make arbitrary HTTP requests from the server, potentially accessing internal services or cloud metadata endpoints. This issue has been patched in version 0.34.0."}], "id": "CVE-2026-65967", "lastModified": "2026-11-12T22:18:51.470", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-65967", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-12T19:37:46.515516Z", "version": "2.0.3"}}]}, "published": "2026-11-11T19:17:44.287", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/getfider/fider/releases/tag/v0.34.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/getfider/fider/security/advisories/GHSA-g445-xwm7-594r"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/getfider/fider/security/advisories/GHSA-g445-xwm7-594r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.34.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "fider", "source": "cna", "vendor": "getfider"}, "product": "fider", "vendor": "getfider"}], "created": "2026-11-12T20:15:08.434285+00:00", "updated": "2026-11-13T07:00:10.310298+00:00", "vendors": ["getfider", "getfider$PRODUCT$fider"]}