Threat database

CVE-2026-108523 is a server-side request forgery (SSRF) vulnerability in Studio-Saelix Sencho versions 0.94.0 and 0.94.1. The flaw exists in the git-sources Browse API Endpoint, specifically in the outboundTarget.ts file, where manipulation of the repo_url argument can lead to SSRF. The vendor states that repository access is a privileged administrative function and disputes the CVE's characterization of the behavior as a privilege-boundary bypass. The vendor has hardened repository access with DNS validation, rejection of certain network targets, disabled redirects, and strict SSH host-key verification. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity). A patch identified by commit 79b86ddcd4aefdd6941f098e35990ab397b13c72 is available to address the issue.

CVE-2026-108522 is an improper authentication vulnerability in Studio-Saelix Sencho versions 0.94.0 and 0.94.1. It affects the /api/auth/login endpoint where manipulation of the X-Forwarded-For header allows attackers to bypass authentication controls remotely. The issue arises because the login limiter trusted client-supplied X-Forwarded-For data without verifying the proxy source. A patch is available that restricts acceptance of forwarding headers to explicitly configured proxy CIDRs and adds a failed-attempt limit based on normalized account identity.

Studio-Saelix Sencho versions 0.97.0 and 0.97.1 contain a server-side request forgery (SSRF) vulnerability in the isValidRemoteUrl function of the Add Remote Node API Endpoint. This vulnerability allows an authenticated user with node-management permission to configure the node API URL to initiate server-side requests. The vulnerability has been publicly disclosed, but exploitation does not allow arbitrary internal response exfiltration. The CVSS 4.0 base score is 5.1, indicating a medium severity level.