CVE-2026-77066: Server-Side Request Forgery (SSRF) in omnivore-app omnivore

The scanFeedsResolver in omnivore-app omnivore's API resolver code passes a caller-supplied URL directly to axios.get without address validation, unlike other paths that use validateUrl() to reject private and reserved IP ranges. This omission enables an authenticated user to perform SSRF attacks by directing the server to request arbitrary internal endpoints. The server parses the response as feed or HTML and returns metadata fields such as url, title, description, and type. While the data disclosed is limited to feed-shaped metadata and RSS/Atom link elements, the vulnerability can be used to probe internal network services. Requests that fail to parse still reveal information about reachable ports via error responses.

An authenticated attacker can exploit this SSRF vulnerability to make the server perform HTTP requests to arbitrary internal endpoints. The disclosed information is limited to metadata extracted from feed or HTML responses, such as URLs, titles, descriptions, and feed types. Unparsable responses can still reveal whether internal ports are reachable based on error behavior. There is no indication of privilege escalation, remote code execution, or broader data disclosure beyond feed metadata. The vulnerability has a medium severity rating (CVSS 5.3).

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting authenticated user input to trusted URLs or implementing server-side validation similar to validateUrl() to reject private and reserved IP ranges in the scanFeedsResolver function.