This vulnerability affects Privoce VoceChat Server up to version 0.5.36 in the open_graph::fetch function of the open_graphic_parse endpoint. By manipulating the URL argument, an attacker can cause the server to make unintended requests to internal or external resources, constituting a server-side request forgery. The vulnerability is remotely exploitable without authentication. Public exploit details have been disclosed, but no official vendor response or patch is available.

Successful exploitation allows an unauthenticated remote attacker to induce the server to send crafted requests to arbitrary URLs. This can lead to information disclosure or interaction with internal systems not otherwise accessible. The CVSS 4.0 score of 6.9 reflects a medium severity impact with low attack complexity and no privileges required. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider implementing network-level restrictions to limit outbound requests from the affected component or disable the vulnerable functionality if possible until a fix is released.