Read the docs
TI-2026-53819 Aliases CVE-2026-77066GHSA-w9wc-vx4j-8xwg

Omnivore Server-Side Request Forgery via the scanFeeds GraphQL Query

Priority MEDIUM 57CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.get(url, rssParserConfig()) with no address validation. The same file guards the subscribe path with validateUrl(), which rejects private and reserved ranges through the private-ip library, and createPageSaveRequest applies the same check, so the omission is specific to this resolver. An authenticated user can direct the server to request arbitrary internal endpoints. The response is parsed as a feed or as HTML and the resolver returns the resulting url, title, description and type fields, so disclosure is limited to feed-shaped metadata and to link elements advertising RSS or Atom feeds; requests that do not parse still distinguish reachable ports from unreachable ones through the resulting error.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00251 16th percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

No affected products listed by the sources yet.

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    omnivore-app omnivore c4d7d8562e6b9aabb1d8e4dabca268e314baa43a

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-53820 Omnivore Stored Server-Side Request Forgery via the setWebhook MutationPriority MEDIUM 57
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-77066
  2. 2026-10-03 Alias added: GHSA-w9wc-vx4j-8xwg

References

Patch 1

Other 3

  • TI-2026-53820 Omnivore Stored Server-Side Request Forgery via the setWebhook Mutation CVSS 4.0MEDIUM 5.3
  • TI-2026-56851 Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in CVSS 4.0CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences