CVE-2026-50552

Koel is a free, open-source music streaming solution. Prior to version 9.7.1, Koel contains a Server-Side Request Forgery (SSRF) vulnerability in the radio station creation endpoint (POST /api/radio/stations). The url field validation rules are declared without the bail keyword, so the HasAudioContentType rule — which issues HTTP requests to the supplied URL — still executes even after the SafeUrl rule has rejected the URL as pointing to a private/reserved address. Any authenticated, non-admin user can therefore coerce the server into making HEAD/GET requests to arbitrary internal hosts. This issue has been patched in version 9.7.1.

• CWE-918

• https://github.com/koel/koel/commit/5f6ce2cefd08f437a269236b677ad971517ccbb6
• https://github.com/koel/koel/security/advisories/GHSA-jr4p-4xjh-fwvw
• https://github.com/koel/koel/security/advisories/GHSA-jr4p-4xjh-fwvw

Published

Jun 12, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50540Kata Containers is an open source project focusing on a stan…9.6
• CVE-2026-50545Fission is an open-source, Kubernetes-native serverless fram…9.9
• CVE-2026-50548Cursor is a code editor built for programming with AI. Prior…9.8
• CVE-2026-50549Cursor is a code editor built for programming with AI. Prior…9.8
• CVE-2026-5055NoMachine Uncontrolled Search Path Element Local Privilege E…7.8
• CVE-2026-50551SiYuan is an open-source personal knowledge management syste…9.9
• CVE-2026-50555Angular is a development platform for building mobile and de…6.1
• CVE-2026-50556Angular is a development platform for building mobile and de…6.1
• CVE-2026-50557Angular is a development platform for building mobile and de…6.1
• CVE-2026-50558Penelope Shell Handler is a post-exploitation shell handler …5.9
• CVE-2026-50559Quarkus is a Java framework for building cloud-native applic…7.5
• CVE-2026-5056GStreamer qtdemux Stack-based Buffer Overflow Remote Code Ex…7.8