This vulnerability exists in gabehf Koito through version 0.3.2. An authenticated user can exploit the SSRF flaw by providing a specially crafted image_url parameter in the PATCH /apis/web/v1/album/{id}/image API endpoint. The server fetches the URL without validating the destination, allowing requests to internal, loopback, link-local, or external hosts. This can lead to unauthorized access to internal services or sensitive information. The CVSS 3.1 base score is 7.7, indicating high severity, with network attack vector, low attack complexity, requiring privileges, no user interaction, and high confidentiality impact but no integrity or availability impact. No patch or official remediation is currently documented.

An attacker with authentication privileges can cause the server to make arbitrary HTTP requests to internal or external hosts, potentially accessing sensitive internal resources or services that are not otherwise exposed. The confidentiality of internal systems may be compromised. There is no reported impact on integrity or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint to trusted users only and monitor for suspicious activity. Consider network-level controls to limit the server's ability to make outbound HTTP requests to sensitive internal addresses.