CVE-2026-125359: Mediary Scout before 2026.11.05 SSRF via PanSou Search Source Setting
Mediary Scout before 2026.11.05 contains a server-side request forgery vulnerability that allows any authenticated user, including non-owner accounts, to set an arbitrary PanSou base URL via savePanSouBaseUrlAction without role checks. Attackers can trigger probePanSou() to send server-side POST requests to internal hosts and use distinct error responses as an oracle for internal host and port discovery.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated user can exploit it, including accounts that are not owners. The vulnerable setting can be changed without role checks.
What does an attacker need to do to use the SSRF capability?
The attacker needs a valid authenticated account, then can set an arbitrary PanSou base URL and trigger probePanSou(). This causes the server to issue POST requests to the chosen target.
What can an attacker learn or reach through the vulnerable requests?
An attacker can direct server-side POST requests toward internal hosts. Distinct error responses can be used as an oracle to discover internal hosts and ports.
Are installations before a specific release affected?
Mediary Scout versions before 2026.11.05 are affected according to the available information.