CVE-2026-50552

Name of the Vulnerable Software and Affected Versions Koel versions prior to 9.7.1

Description An authenticated, non-admin user can cause the server to make HEAD or GET requests to arbitrary internal hosts. This occurs because the validation rules for the url field in the "POST /api/radio/stations" endpoint are declared without the bail keyword. Consequently, the HasAudioContentType rule, which performs HTTP requests to the provided URL, executes even if the SafeUrl rule has already identified the URL as a private or reserved address. This leads to Server-Side Request Forgery (SSRF), a condition where a server is tricked into making requests to an unintended location.

Recommendations Update to version 9.7.1.