CVE-2026-3789

A vulnerability was detected in Bytedesk up to 1.3.9. Affected is the function getModels of the file source-code/src/main/java/com/bytedesk/ai/springai/providers/gitee/SpringAIGiteeRestService.java of the component SpringAIGiteeRestController. Performing a manipulation of the argument apiUrl results in server-side request forgery. Remote exploitation of the attack is possible. The exploit is now public and may be used. Upgrading to version 1.4.5.4 is able to address this issue. The patch is named 975e39e4dd527596987559f56c5f9f973f64eff7. Upgrading the affected component is advised.

• CWE-918

• https://github.com/Bytedesk/bytedesk/Product
• https://github.com/Bytedesk/bytedesk/commit/975e39e4dd527596987559f56c5f9f973f64eff7Patch
• https://github.com/Bytedesk/bytedesk/issues/21Exploit, Vendor Advisory
• https://github.com/Bytedesk/bytedesk/issues/21#issue-3993531226Exploit, Vendor Advisory
• https://github.com/Bytedesk/bytedesk/issues/21#issuecomment-3976672522Exploit, Vendor Advisory
• https://github.com/Bytedesk/bytedesk/releases/tag/v1.4.5.4Release Notes
• https://vuldb.com/?ctiid.349756Permissions Required, VDB Entry
• https://vuldb.com/?id.349756Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.768044Third Party Advisory, VDB Entry

Published

Mar 9, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3783When an OAuth2 bearer token is used for an HTTP(S) transfer,…5.3
• CVE-2026-3784curl would wrongly reuse an existing HTTP proxy connection d…6.5
• CVE-2026-3785A vulnerability was identified in EasyCMS up to 1.6. The aff…8.8
• CVE-2026-3786A security flaw has been discovered in EasyCMS up to 1.6. Th…8.8
• CVE-2026-3787A weakness has been identified in UltraVNC 1.6.4.0 on Window…7
• CVE-2026-3788A security vulnerability has been detected in Bytedesk up to…8.8
• CVE-2026-3790A flaw has been found in SourceCodester Sales and Inventory …8.8
• CVE-2026-3791A vulnerability has been found in SourceCodester Sales and I…8.8
• CVE-2026-3792A vulnerability was found in SourceCodester Sales and Invent…8.8
• CVE-2026-3793A vulnerability was determined in SourceCodester Sales and I…8.8
• CVE-2026-3794A vulnerability was identified in doramart DoraCMS 3.0.x. Th…9.8
• CVE-2026-3795A security flaw has been discovered in doramart DoraCMS 3.0.…9.8