Server-Side Request Forgery in Omnivore Affects User Data Integrity

CVE-2026-77066

What is CVE-2026-77066?

The vulnerability in the Omnivore API's scanFeedsResolver allows the passing of unsanitized URLs directly to an external request handler. This lack of proper validation means that an authenticated user can potentially cause the server to access arbitrary internal endpoints, leading to the possible disclosure of sensitive metadata related to feeds, including titles, links, and descriptions. Although the system employs some validation mechanisms for other paths, this specific resolver remains exposed, making it critical for users to ensure their application configurations are secure and up-to-date.

References