CVE-2026-79788

Name of the Vulnerable Software and Affected Versions Dradis Community Edition (affected versions not specified)

Description An authorization bypass exists in the ProvidersController and AgentsController because the admin required before action depends on the defined?(Dradis::Pro) constant, which is not defined in the Community Edition. This allows any authenticated non-admin user to create an AI provider pointing to an arbitrary HTTP/HTTPS address, including internal or link-local hosts. By reassigning the built-in Roslin agent to this provider, an attacker can trigger a server-side request forgery (SSRF), where the server sends a request to the attacker-supplied URL. For non-2xx responses, the response body is reflected to the attacker's browser via ActionCable/Turbo Stream error messages, allowing the SSRF to be readable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.