A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. (CVE-2026-108523)

CVE-2026-108523 describes a server-side request forgery vulnerability in Studio-Saelix Sencho versions up to 0.94.1 affecting the git-sources Browse API Endpoint's outboundTarget.ts file. The vulnerability arises from manipulation of the repo_url argument, which could lead to SSRF attacks. The vendor clarifies that repository access is a privileged administrative function and disputes the CVE's characterization, emphasizing no demonstrated privilege boundary bypass or unprivileged user access. As a defense-in-depth measure, the vendor hardened repository access by validating and pinning DNS resolution, rejecting loopback, link-local, multicast, special-use, and metadata targets, disabling redirects and inherited proxy routing, and enforcing strict SSH host-key verification. A patch identified by commit 79b86ddcd4aefdd6941f098e35990ab397b13c72 is recommended to mitigate this issue.

The vulnerability could allow a privileged user to perform server-side request forgery via the repo_url argument, potentially causing the server to make unintended network requests. However, the vendor states that this function is privileged and no privilege escalation or unprivileged access is demonstrated. The impact is therefore limited to users with existing administrative privileges. The CVSS score of 4.3 reflects a low severity impact with limited confidentiality impact and no integrity or availability impact.

A patch identified by commit 79b86ddcd4aefdd6941f098e35990ab397b13c72 is available and should be applied to address this vulnerability. The vendor has also implemented additional hardening controls including DNS validation, rejection of certain network targets, disabling redirects and proxy routing, and strict SSH host-key verification. Users should apply the patch and verify these mitigations are in place. No additional action is required for unprivileged users as the vulnerability affects a privileged administrative function.