CVE-2026-50888 describes an authenticated SSRF vulnerability in the custom scraper subsystem of Benjamin Jonard Koillection v1.8.0. An attacker with legitimate access can exploit this flaw by providing a specially crafted URL, enabling scanning of internal network resources. The vulnerability is categorized under CWE-918 (Server-Side Request Forgery). The CVSS 3.1 base score is 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, and high confidentiality and integrity impact. There is no known exploit in the wild and no vendor-provided patch or mitigation at this time.

Successful exploitation allows an authenticated attacker to perform SSRF attacks, potentially revealing sensitive internal network information and compromising confidentiality and integrity of internal resources. There is no direct impact on availability. The high CVSS score reflects the severity of data exposure and integrity risks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable subsystem to trusted users only and monitor for suspicious activity related to URL inputs in the custom scraper subsystem. Avoid exposing the application to untrusted networks where possible.