CVE-2026-72597

The CVSS 6.5 assigned to this Friendica SSRF vulnerability is misleading in common deployment contexts. The issue is straightforward: an attacker with a self-registered account can force the server to make HTTP requests to arbitrary addresses through the link-preview endpoint. That HTTP capability, paired with cloud infrastructure, becomes a metadata service access vector. AWS, GCP, and Azure all respond to requests at 169.254.169.254 or equivalent with instance credentials, IAM roles, and secrets. A Friendica instance running on cloud infrastructure becomes a credential-harvesting platform once an attacker obtains a valid account — and registration is effectively open in any public deployment. The existence of IP filtering elsewhere in the codebase is telling. It means someone understood the risk and implemented controls in some places but not this one. That inconsistency is an architectural failure: each developer implementing a new outbound request endpoint must independently know to apply filtering, and the path of least resistance — a direct `file_get_contents($userUrl)` or similar — requires zero knowledge of existing security patterns. Without a centralized, secure-by-default HTTP client that enforces IP deny-listing by default regardless of what the calling code intends, the next SSRF in this codebase is probably already written. What you should do: first, treat this as a critical-priority vulnerability if your Friendica instance runs on any major cloud provider. Second, implement network-level deny-listing for 169.254.169.254 and the equivalent metadata addresses for GCP and Azure at your VPC or security group level — don't rely solely on application-level fixes. Third, scan your deployment for other endpoints that make outbound HTTP requests and verify they apply equivalent controls. The patch will close this instance; it won't close the vulnerability class. The gap between the assigned score and what this enables in cloud environments is the real analytical failure — and it should inform how you prioritize remediation.

Reviewed through automated stages and approved by a human before publication.