Fireshare, a self-hosted media and link sharing application, has an SSRF vulnerability (CWE-918) in versions before 1.6.16. Two API endpoints, POST /api/test-discord-webhook and POST /api/test-webhook, lack the @login_required decorator, allowing unauthenticated attackers to make the server issue arbitrary HTTP POST requests to attacker-supplied URLs. This includes potential access to internal network addresses and cloud metadata services. The vulnerability requires no credentials or prior access. Version 1.6.16 contains a patch that adds the necessary authentication checks.

An unauthenticated attacker can exploit this SSRF vulnerability to make the Fireshare server send arbitrary HTTP POST requests to internal or external URLs of the attacker's choosing. This can lead to unauthorized interactions with internal network services or cloud metadata endpoints, potentially exposing sensitive information or enabling further attacks. The vulnerability does not directly disclose data but can be used as a pivot point for additional exploitation. The CVSS score is 7.2 (high severity), reflecting network attack vector, no privileges required, no user interaction, partial confidentiality impact, and low availability impact.

Upgrade Fireshare to version 1.6.16 or later, which includes a patch adding the @login_required decorator to the affected API endpoints, preventing unauthenticated access. No other mitigation is required as the vulnerability is fixed in this official release.