Unauthenticated Server-Side Request Forgery in Grimoire by Goniszewski

CVE-2026-119709

What is CVE-2026-119709?

Grimoire, prior to version 1.0.0, is vulnerable to an unauthenticated server-side request forgery (SSRF) in its /api/fetch-metadata POST handler. This vulnerability allows attackers to submit arbitrary user-supplied URLs, which are processed without authentication checks, leading to potential exposure of sensitive internal data. Specifically, the flaw can be exploited to access loopback, internal network, or cloud metadata endpoints, allowing malicious users to retrieve sensitive information such as parsed titles, descriptions, and page content.

References