CVE-2026-28508

The record

Idno is a social publishing platform. Prior to version 1.6.4, a logic error in the API authentication flow causes the CSRF protection on the URL unfurl service endpoint to be trivially bypassed by any unauthenticated remote attacker. Combined with the absence of a login requirement on the endpoint itself, this allows an attacker to force the server to make arbitrary outbound HTTP requests to any host, including internal network addresses and cloud instance metadata services, and retrieve the response content. This issue has been patched in version 1.6.4.

Affected packages

Related vulnerabilities

• GHSA-fcrh-fqxh-6fx6 Idno Vulnerable to Unauthenticated SSRF via URL Unfurl Endpoint Same vulnerability
• CVE-2026-28507 Idno is a social publishing platform. Also affects idno/known
• GHSA-37j7-56xc-c468 Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path… Also affects idno/known
• GHSA-78wq-6gcv-w28r Known affected by Account Takeover via Password Reset Token Leakage Also affects idno/known
• CVE-2026-26273 Known is a social publishing platform. Also affects idno/known
• CVE-2026-114730 Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a… CWE-918
• CVE-2026-87953 Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider… CWE-918
• CVE-2026-114634 WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in… CWE-918