CVE-2026-72591: Koito - Authenticated Server-Side Request Forgery via Album Image URL Parameter
A server-side request forgery (SSRF) vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/{id}/image endpoint. The application fetches the supplied URL server-side without validating the destination host or blocking access to private, loopback, link-local, or internal addresses.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72591?
The severity of CVE-2026-72591 is high, with a CVSS score of 7.7.
How do I fix CVE-2026-72591?
To mitigate CVE-2026-72591, it is recommended to validate and sanitize the input for the image_url parameter before processing.
Who is affected by CVE-2026-72591?
Authenticated users of the Koito application version v0.3.2 and earlier are affected by CVE-2026-72591.
What type of vulnerability is CVE-2026-72591?
CVE-2026-72591 is classified as a server-side request forgery (SSRF) vulnerability.
What functionality can be exploited in CVE-2026-72591?
CVE-2026-72591 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts.