This vulnerability exists in the fetch function of the getCodeByLink endpoint in HBAI-Ltd Toonflow-app (versions 1.1.0 and 1.1.1). By manipulating the Link parameter, an attacker can cause the server to make unauthorized requests to internal or external resources, constituting a server-side request forgery. The vendor acknowledges the high-risk nature of this interface and advises that users must be aware of the risks before using it. The exploit has been publicly disclosed, but there is ongoing doubt about the vulnerability's real existence. No official fix or patch has been provided as of the publication date.

Successful exploitation could allow an attacker with low privileges to induce the server to make arbitrary HTTP requests, potentially accessing internal systems or services not otherwise reachable. The impact is rated medium severity with a CVSS 4.0 score of 5.3. There are no known exploits in the wild, and the vendor has not confirmed the vulnerability's existence or provided remediation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor highlights that the /getCodeByLink interface is inherently high-risk and should only be used by users who understand these risks. Until an official fix is available, restrict access to this interface and avoid using it if possible.