CVE-2026-73432

Name of the Vulnerable Software and Affected Versions Vulnerability-Lookup (affected versions not specified)

Description A server-side request forgery (SSRF) issue exists in the remote-instance synchronization functionality. The system validated remote instance addresses only for basic URL syntax before storage, while the synchronization worker later processed these addresses using requests.get() with automatic redirect handling and no network-boundary restrictions. An authenticated administrator with admin:access permission could configure a remote instance pointing to internal, loopback, link-local, or cloud metadata HTTP(S) services. Additionally, a publicly accessible URL could be used to redirect to an internal destination since redirects were followed without revalidation. This allows a privileged attacker to probe or interact with services accessible from the server's network context, such as private network services or cloud instance metadata endpoints.

Recommendations Apply the available patch to implement a shared outbound URL policy that restricts remote instances to HTTP(S), rejects non-public IP addresses, resolves hostnames at request time, and validates each redirect destination. As a temporary mitigation, restrict the admin:access permission to trusted users only.