SZB-6b134534ab
EUVD lists unauthenticated SSRF in Grimoire before 1.0.0
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- goniszewski
- Product
- Grimoire
- First seen
Summary
The EUVD entry EUVD-2026-114114 (CVSS v3.1 score 6.9) reports an unauthenticated server-side request forgery flaw in Grimoire's /api/fetch-metadata handler. According to the entry, attackers can submit URLs that the server fetches without authentication checks.
If you use goniszewski
Upgrade Grimoire to version 1.0.0 or later
Restrict outbound network access from the Grimoire server
Limit access to the /api/fetch-metadata endpoint at the network edge
What the sources say 1
· Mastodon: “Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata() without authentication checks.” Source