CVE-2026-72597

Name of the Vulnerable Software and Affected Versions Friendica versions prior to 2026.08-dev

Description An authenticated user with a self-registered account can perform a server-side request forgery (SSRF) through the link-preview endpoint. This occurs because the endpoint fetches user-supplied URLs without implementing an internal IP deny list, which is a security measure used to block requests to private network addresses. This flaw allows an attacker to probe internal network services or access cloud metadata services.

Recommendations Update Friendica to a version later than 2026.08-dev. Restrict access to the link-preview endpoint to minimize the risk of internal network scanning.