Unauthorized Network Access Vulnerability in OpenSupports by Fluidattacks

CVE-2025-10695

What is CVE-2025-10695?

OpenSupports versions prior to 4.11.0 are susceptible to a server-side request forgery (SSRF) vulnerability. This issue arises from two diagnostic endpoints that allow unauthorized actors to establish arbitrary outbound network connections to any attacker-defined destination. The endpoints, which require permission set to 'any', expose internal services and enable potential internal network scanning, leading to exposure of sensitive data and services. It is critical for users of affected versions to review and implement necessary security measures to mitigate this risk.

References