CVE-2026-72591 PUBLISHED

Koito - Authenticated Server-Side Request Forgery via Album Image URL Parameter

Assigner: TuranSec
Reserved: 10.08.2026 Published: 10.08.2026 Updated: 10.08.2026

A server-side request forgery (SSRF) vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted image_url value in the PATCH /apis/web/v1/album/{id}/image endpoint.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS Score: 7.7

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	gabehf
Product	Koito
Versions	Default: unknown affected from 0 to 0.3.2 (incl.)

Credits

muhammadamin qudratov finder

References

Product

Problem Types

CWE-918: Server-Side Request Forgery (SSRF) CWE