This vulnerability (CVE-2026-72591) affects gabehf Koito through version 0.3.2. An authenticated user can exploit an SSRF flaw by sending a specially crafted image_url parameter in the PATCH /apis/web/v1/album/{id}/image endpoint, causing the server to perform HTTP requests to arbitrary hosts. The vulnerability is classified under CWE-918 (Server-Side Request Forgery). The CVSS v3.1 base score is 7.7, reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, high confidentiality impact, and no integrity or availability impact. No official patch or remediation guidance is currently available, and no known exploits in the wild have been reported.

An authenticated attacker can leverage this SSRF vulnerability to make the server send HTTP requests to arbitrary internal or external systems. This can lead to unauthorized information disclosure (confidentiality impact) but does not affect data integrity or availability according to the CVSS vector. The scope of the vulnerability is changed, indicating potential impact beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated user privileges to trusted users only and monitor for suspicious activity related to the vulnerable API endpoint. Avoid exposing sensitive internal resources accessible via the server. No official remediation or temporary fix is currently documented.