SSRF Vulnerability in Ideon by 3xpyth0n
CVE-2026-68507

6.9MEDIUM

Key Information:

Vendor

3xpyth0n

Status
Ideon
Vendor
CVE Published:
11 November 2026

What is CVE-2026-68507?

The Ideon application, a self-hosted visual workspace, suffers from a severe server-side request forgery (SSRF) vulnerability. Prior to version 0.9.5, the link-preview endpoint of Ideon lacked any form of authentication, allowing malicious actors to exploit this endpoint to fetch any URL without restrictions. Although the application implements a general-purpose SSRF guard, it is ineffective in this instance since the endpoint is not protected by a login mechanism. Furthermore, the IP blocklist is bypassed through the 0.0.0.0 address, enabling an attacker to access the server's internal loopback interface, which poses significant security risks. Users are strongly recommended to update to version 0.9.5 or later to mitigate this vulnerability.

Affected Version(s)

ideon < 0.9.5

References

https://github.com/3xpyth0n/ideon/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/3xpyth0n/ideon/releases/tag/v0.9.5
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.