Vulnerability · Published Aug 11, 2026 · Assigned by TuranSec

CVE-2026-72597Friendica Friendica - Server-Side Request Forgery

Medium 6.5

In plain English

A medium-severity server-side request forgery in Friendica from Friendica. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 72.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny list. An attacker can use this to scan the internal network or access cloud metadata services.

Affected products (as reported)

Vendor	Product	Versions
Friendica	Friendica	0 – through 2026.08-dev

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Project Repository