This vulnerability, identified as CWE-918, affects Vehica Core versions up to 1.0.104 and involves Server-Side Request Forgery (SSRF). SSRF vulnerabilities enable an attacker to make the server perform unintended requests, which can lead to information disclosure, modification, or denial of service. The CVSS vector indicates the attack requires network access, high attack complexity, low privileges, no user interaction, and impacts confidentiality, integrity, and availability to a limited extent. No patch or official remediation level has been published, and no known exploits have been reported.

An attacker with limited privileges can exploit this SSRF vulnerability to cause the server to send crafted requests to internal or external systems. This may lead to limited confidentiality loss, integrity compromise, and availability disruption. The medium severity score reflects these moderate impacts. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No vendor-provided mitigations or temporary fixes are currently documented.