Threat Intelligence Database

CVE-2026-108523 is a server-side request forgery (SSRF) vulnerability in Studio-Saelix Sencho versions 0.94.0 and 0.94.1. It affects the git-sources Browse API Endpoint, specifically the outboundTarget.ts file, where manipulation of the repo_url argument can lead to SSRF. The vendor disputes the severity of the issue, noting that repository access is a privileged administrative function and that no privilege boundary bypass is demonstrated. The vendor has implemented hardening measures including DNS pinning, rejection of certain network targets, disabling redirects and proxy routing, and strict SSH host-key verification. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity). A patch identified by commit 79b86ddcd4aefdd6941f098e35990ab397b13c72 is available to address the issue.

CVE-2026-108522 is an improper authentication vulnerability in Studio-Saelix Sencho versions 0.94.0 and 0.94.1. It arises from the login endpoint improperly trusting the client-supplied X-Forwarded-For header without a trusted proxy boundary, allowing attackers to manipulate this header to bypass authentication controls. The vulnerability can be exploited remotely. A patch is available that changes the handling of forwarding headers to accept them only from explicitly configured proxy CIDRs and adds a separate failed-attempt limit keyed by normalized account identity.

Studio-Saelix Sencho versions 0.97.0 and 0.97.1 contain a server-side request forgery (SSRF) vulnerability in the isValidRemoteUrl function of the Add Remote Node API Endpoint. This vulnerability allows an authenticated user with node-management permission to configure the node API URL and initiate server-side requests. The vulnerability has been publicly disclosed, but exploitation does not allow arbitrary internal response exfiltration. The CVSS 4.0 score is 5.1, indicating medium severity.