The scanFeedsResolver in omnivore-app omnivore's packages/api/src/resolvers/subscriptions/index.ts forwards a caller-supplied URL directly to axios.get(url, rssParserConfig()) without address validation, unlike other functions that reject private and reserved IP ranges. This omission allows an authenticated user to induce the server to make requests to arbitrary internal endpoints. The server parses the response as a feed or HTML and returns limited metadata fields (url, title, description, type). Even when parsing fails, error responses can reveal the reachability of internal ports. No vendor advisory or patch information is currently provided.

An authenticated attacker can exploit this SSRF vulnerability to make the server perform HTTP requests to internal network endpoints. While the returned data is limited to feed-like metadata, the vulnerability can disclose the existence and reachability of internal services and ports. This may aid in further internal reconnaissance but does not directly allow arbitrary code execution or data exfiltration beyond feed metadata.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user input to validated URLs or implement address validation similar to other guarded paths. Monitor for updates from the vendor regarding official fixes.