Read the docs
TI-2026-22770 Aliases CVE-2026-28508GHSA-fcrh-fqxh-6fx6

Idno: Unauthenticated SSRF via URL Unfurl Endpoint

Priority MEDIUM 47CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

Idno is a social publishing platform. Prior to version 1.6.4, a logic error in the API authentication flow causes the CSRF protection on the URL unfurl service endpoint to be trivially bypassed by any unauthenticated remote attacker. Combined with the absence of a login requirement on the endpoint itself, this allows an attacker to force the server to make arbitrary outbound HTTP requests to any host, including internal network addresses and cloud instance metadata services, and retrieve the response content. This issue has been patched in version 1.6.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00714 53rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed idno (idno): 1.6.4idno/known (Packagist): 1.6.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
idnoidnobefore 1.6.41.6.4Patch availableCNA
—idno/known (Packagist)before 1.6.41.6.4Patch availableGHSA-fcrh-fqxh-6fx6
  • idno Vendoridno Affected before 1.6.4 Fixed in 1.6.4 Patch available CNA
  • idno/known (Packagist) Vendor— Affected before 1.6.4 Fixed in 1.6.4 Patch available GHSA-fcrh-fqxh-6fx6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:withknown:known:*:*:*:*:*:*:*:*before 1.6.4Vulnerableidno
  • cpe:2.3:a:withknown:known:*:*:*:*:*:*:*:* Versions before 1.6.4 Vulnerable ·idno

Remediation

  • Fix · CNA idno (idno) Fixed in 1.6.4
  • Fix · GHSA-fcrh-fqxh-6fx6 idno/known (Packagist) Fixed in 1.6.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-28508
  2. 2026-10-03 Alias added: GHSA-fcrh-fqxh-6fx6

References

Exploit 1

Advisory 1

Other 2

  • TI-2026-21243 Known affected by Account Takeover via Password Reset Token Leakage CVSS 3.0CRITICAL 9.8
  • TI-2026-22769 Idno: Remote Code Execution via Chained Import File Write and Template Path Traversal CVSS 4.0HIGH 8.6
  • TI-2022-14517 Known v1.3.1+2020120201 was discovered to allow attackers to perform an account takeover… CVSS 3.1HIGH 8.8
  • TI-2022-13859 An issue in the isSVG() function of Known v1.2.2+2020061101 allows attackers to execute… CVSS 3.1MEDIUM 6.1
  • TI-2022-13308 A cross-site scripting (XSS) vulnerability in Known v1.2.2+2020061101 allows… CVSS 3.1MEDIUM 5.4
  • TI-2022-12959 Known v1.3.1 was discovered to contain an Insecure Direct Object Reference (IDOR). CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences