Mediary Scout versions before 2026.11.05 contain a server-side request forgery (SSRF) vulnerability. This flaw allows any authenticated user, including those without ownership roles, to set an arbitrary PanSou base URL via the savePanSouBaseUrlAction function without proper role checks. Exploitation enables attackers to make the server send POST requests to internal hosts and use error responses to discover internal hosts and ports.