CVE-2026-108521: Server-Side Request Forgery in Studio-Saelix Sencho

CVE-2026-108521 is a server-side request forgery vulnerability in Studio-Saelix Sencho affecting versions 0.97.0 and 0.97.1. The flaw exists in the isValidRemoteUrl function within backend/src/utils/validation.ts, part of the Add Remote Node API Endpoint. An authenticated user with node-management permission can manipulate the node API URL to cause the server to make unintended requests. While the vulnerability enables server-side requests, the vendor confirms it does not permit arbitrary internal response exfiltration. The vulnerability is remotely exploitable and has been publicly disclosed.

An attacker with authenticated node-management permissions can cause the server to make arbitrary HTTP requests, potentially accessing internal or protected resources. However, the vulnerability does not allow arbitrary exfiltration of internal responses, limiting the impact. The medium CVSS score reflects the moderate risk due to required privileges and limited data exposure.

No official patch or fix has been confirmed or provided by the vendor at this time. Since the vulnerability requires authenticated access with node-management permission, restricting such permissions to trusted users can reduce risk. Monitor vendor advisories for updates or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.