CVE-2026-48053

The CVSS 5.8 score for this SSRF in Kolibri badly understates the actual risk, and the gap isn't a scoring artifact — it's a structural failure to account for what makes this specific instance dangerous. The vulnerability is an unauthenticated endpoint that fetches attacker-controlled URLs and reflects the response body back to the caller. That reflection is the exploitability pivot. Most SSRF cases force attackers to infer results through timing or error messages — here, the attacker gets the actual content of whatever the server fetches. That changes the attack from an inference game to a read game, and it converts a low-severity proxy bug into an internal reconnaissance and exfiltration vector. This matters because Kolibri's deployment context compounds the risk. The platform runs in schools and community centers, typically on networks that contain administrative interfaces, local databases, and internal services never intended for external access. An SSRF from such a host doesn't just proxy to the open internet — it bridges the internal LAN to whatever the Kolibri server can reach. The reflected responses let attackers enumerate what's there, pull configuration data, grab session tokens from internal APIs, and identify adjacent vulnerabilities to chain with this initial access. The remediation review identified four separate viewsets exhibiting the same vulnerable pattern — response-body reflection from URL-fetching without authentication boundaries. That repetition signals a systemic issue in how the codebase handles URL parameters, not isolated oversight. Treat the four known endpoints as a floor: audit for similar patterns elsewhere, particularly in any content-fetching or sync functionality. The pattern likely exists in code that was never flagged as security-sensitive because it was considered peripheral "utility" logic. Prioritize these actions: First, verify whether the four identified endpoints have been patched in your deployed version — the fix should restrict URL fetching to intended origins, require authentication, or disable reflection entirely. Second, conduct a code audit of any other endpoints that accept URLs as parameters and perform remote fetches; the four-viewset pattern suggests copy-paste propagation across the codebase. Third, review application logs for evidence of historical exploitation — reflected responses from internal services may already be present in logfiles, creating a secondary exposure if an attacker gains filesystem access later. Fourth, treat any SSRF with response-body reflection as high-severity in internal network contexts regardless of CVSS score — the scoring framework doesn't model the compound risk of reflection plus LAN deployment plus offline remediation cycles. Administrators receiving this disclosure should recognize that the 5.8 score reflects a technical base metric, not operational risk in this deployment profile. The scoring gap exists because CVSS doesn't weight response reflection, internal network topology, or remediation half-life in offline-first environments. Treat this as urgent regardless.

Reviewed through automated stages and approved by a human before publication.