A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. (CVE-2026-108521)

CVE-2026-108521 is a server-side request forgery vulnerability in Studio-Saelix Sencho versions up to 0.97.1. It affects the isValidRemoteUrl function in backend/src/utils/validation.ts within the Add Remote Node API Endpoint component. Authenticated users with node-management permission can manipulate the node API URL to trigger server-side requests. The vendor confirms that while server-side request capability is demonstrated, arbitrary internal response exfiltration is not possible. The vulnerability is publicly disclosed but no known exploits are reported in the wild.

An attacker with node-management permission can cause the server to make arbitrary requests, potentially impacting confidentiality, integrity, and availability to a limited extent. However, the vendor notes that arbitrary internal response exfiltration is not achievable, limiting the impact. The CVSS score of 4.7 reflects a low severity impact with network attack vector, low complexity, and required privileges.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since exploitation requires node-management permission, restricting access to authorized users reduces risk. Monitor vendor communications for updates on fixes or mitigations.