Server-Side Request Forgery in Dradis Community Edition Affects Users

CVE-2026-79788

What is CVE-2026-79788?

In Dradis Community Edition, a flaw in the ProvidersController and AgentsController allows authenticated non-admin users to bypass authorization checks leading to server-side request forgery (SSRF). This occurs as the admin_required check is based on a constant, 'Dradis::Pro', which is never defined in the Community Edition. Consequently, an attacker can create an AI provider using any arbitrary HTTP/HTTPS address, including local network addresses. If an interaction is initiated, the application sends a request to the specified URL, and any non-2xx responses expose the target's response body through ActionCable/Turbo Stream error messages, rendering the SSRF exploit visible to the attacker.

References