This vulnerability exists in the fetch function of the getCodeByLink endpoint in HBAI-Ltd Toonflow-app versions 1.1.0 and 1.1.1. By manipulating the Link argument, an attacker may cause the server to perform unintended requests, constituting a server-side request forgery (SSRF). The vendor acknowledges the high-risk nature of this interface and advises that users must understand these risks before enabling its use. No official patch or remediation guidance is currently available, and the vulnerability's existence is somewhat disputed.

If exploited, this SSRF vulnerability could allow an attacker to make the server send arbitrary requests, potentially accessing internal resources or services not otherwise reachable. However, the impact is moderated by the vendor's indication that the interface is high-risk and should be used only by informed users. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid enabling or using the /getCodeByLink interface unless they fully understand and accept the associated risks. Monitor vendor communications for any official fixes or updates.