CVE-2026-72597: Friendica Friendica - Server-Side Request Forgery

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-11 · updated 2026-10-24
Weakness: CWE-918

Description

A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny list. An attacker can use this to scan the internal network or access cloud metadata services.

Affected products

Friendica: through 2026.08-dev

References

https://github.com/friendica/friendica

Get alerted when CVE-2026-72597 or the next vulnerability affects your stack