Libredesk, a self-hosted customer support desk application, suffers from a vulnerability identified as CVE-2026-26957, which affects all versions prior to 1.0.2-0.20260215211005-727213631ce6. The root cause is the failure to properly validate destination URLs configured for webhooks. Specifically, an attacker with authenticated Application Admin privileges can manipulate webhook destination URLs to force the Libredesk server to initiate HTTP requests to arbitrary internal or cloud infrastructure addresses. This behavior constitutes a server-side request forgery (SSRF) vulnerability (CWE-918). Additionally, the vulnerability involves CWE-209, indicating that error messages generated may leak sensitive information, potentially aiding attackers in reconnaissance or exploitation. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required beyond admin authentication, and limited scope impact. Exploitation could allow attackers to access internal services not normally exposed externally, potentially compromising cloud infrastructure or internal corporate networks hosting the service. The vulnerability has been fixed in version 1.0.2-0.20260215211005-727213631ce6. No public exploits are known at this time.

The primary impact of this vulnerability is the potential compromise of internal network resources and cloud infrastructure through SSRF attacks initiated by the vulnerable Libredesk server. An attacker with Application Admin credentials can pivot into internal systems that are otherwise inaccessible externally, potentially leading to unauthorized data access, lateral movement, or disruption of internal services. Sensitive information may also be leaked via error messages, aiding attackers in further exploitation. Organizations relying on Libredesk for customer support risk exposure of internal assets, which could lead to data breaches, service interruptions, or escalation of privileges within their environment. The impact is heightened in environments where Libredesk is deployed in cloud or hybrid infrastructures with sensitive internal services behind firewalls.

1. Upgrade Libredesk immediately to version 1.0.2-0.20260215211005-727213631ce6 or later, where the vulnerability is patched. 2. Restrict Application Admin privileges strictly to trusted personnel to reduce the risk of malicious exploitation. 3. Implement network segmentation and firewall rules to limit the Libredesk server's ability to reach sensitive internal endpoints, minimizing SSRF impact. 4. Monitor and audit webhook configurations regularly for unauthorized or suspicious destination URLs. 5. Employ web application firewalls (WAFs) with SSRF detection capabilities to detect and block malicious outbound requests. 6. Review and sanitize error messages to avoid leaking sensitive information, aligning with CWE-209 mitigation best practices. 7. Conduct internal penetration testing focusing on SSRF vectors to identify residual risks. 8. Maintain up-to-date logging and alerting on unusual outbound HTTP requests from the Libredesk server.