CVE-2026-108521: Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery
A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The node API URL could be configured by an authenticated user with node-management permission and used to initiate server-side requests. [T]he report demonstrates server-side request capability but not arbitrary internal response exfiltration."
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with node-management permission can configure a node API URL that causes the server to initiate requests. Exploitation is remote and requires high privileges.
Which versions are affected?
Studio-Saelix Sencho versions up to and including 0.97.1 are affected.
Does the available information show that internal responses can be read by the attacker?
No. The vendor confirms server-side request capability, but states that the report does not demonstrate arbitrary internal response exfiltration.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.