Server-side request forgery in ArcReel provider test endpoint
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.
Summary
ArcReel versions 0.32.0, 0.33.0 and 0.34.0 are affected. Manipulating the provider test endpoint (/api/v1/providers/{id}/test) leads to server-side request forgery (CWE-918). A remote attacker with low privileges can exploit this, and a public exploit has been disclosed and may be used.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.0. The impacted element is an unknown function of the file /api/v1/providers/{id}/test of the component Provider Test-Connection Endpoint. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | ArcReel | 0.32.0; 0.33.0; 0.34.0 | — | No fix listed | CNA |
- ArcReel Vendor— Affected 0.32.0; 0.33.0; 0.34.0 Fixed in — No fix listed CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:arcreel:arcreel:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:arcreel:arcreel:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
The sources list no fixed version for ArcReel.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Timeline
- 2026-11-03 Threatist record created from CVE-2026-121581
- 2026-11-04 Alias added: GHSA-8xfr-4vj4-6h48
References
Sources
- CVE-2026-121581 · CVE Program
- CVE-2026-121581 · NVD
- FIRST EPSS
- GHSA-8xfr-4vj4-6h48 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences