CVE-2026-77164: SSRF
Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST /apps/circles/event/ and POST /apps/circles/incoming/ reach this code path, allowing any unauthenticated user to force the server to issue a GET request to an internal address.
The response body of the internal request is never returned to the requester, so this is blind SSRF: an attacker can determine whether an internal service is reachable, but cannot read its response contents through this endpoint alone.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can reach the affected code path through the public POST /apps/circles/event/ and POST /apps/circles/incoming/ endpoints. No account or prior trust relationship with a remote instance is required.
What does an attacker need to control?
The attacker needs to supply a keyId URL that points to an internal or private address. The application fetches that URL before establishing trust in the remote instance and permits local/private destinations for this request.
What can an attacker learn or do through the SSRF?
This is blind SSRF: the attacker can cause the server to issue a GET request to an internal address and infer whether an internal service is reachable. The internal response body is not returned through these endpoints.
Are default SSRF protections sufficient?
No. This code path explicitly allows local and private addresses, bypassing Nextcloud core SSRF protections for the signature-verification request.