CVE-2026-77066

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An authenticated user can trigger the server to make requests to arbitrary internal endpoints because the scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes a user-supplied url directly to axios.get() without address validation. While other paths use validateUrl() to reject private and reserved IP ranges, this specific resolver lacks such checks. The impact is limited to the disclosure of feed-shaped metadata and link elements advertising RSS or Atom feeds from the response. Additionally, the resulting errors allow an attacker to distinguish between reachable and unreachable internal ports.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.