CVE-2026-72591

Name of the Vulnerable Software and Affected Versions gabehf/Koito versions prior to 0.3.3

Description A server-side request forgery (SSRF) issue allows an authenticated user to force the server to perform HTTP requests to arbitrary internal or external hosts. This occurs when a crafted image url value is supplied to the 'PATCH /apis/web/v1/album/{id}/image' endpoint. The application fetches the provided URL server-side without validating the destination host or blocking access to private, loopback, link-local, or internal addresses. SSRF is a flaw where an attacker can induce a server-side application to make requests to an unintended location.

Recommendations Update gabehf/Koito to version 0.3.3 or later. Avoid using the image url parameter in the 'PATCH /apis/web/v1/album/{id}/image' endpoint until the update is applied.