CVE-2026-72598

A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax via FILTER_VALIDATE_URL but applies no IP or host denylist. When the registered event fires, the server issues an HTTP POST to the attacker-supplied internal URL.

• CWE-918

• https://github.com/apioo/fusio

Published

Aug 11, 2026

Last Modified

Aug 11, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-72592An unrestricted file upload vulnerability in dulldusk/phpfm …9.8
• CVE-2026-72593A missing authentication vulnerability in dulldusk/phpfm thr…9.8
• CVE-2026-72594A stored cross-site scripting (XSS) vulnerability in lobehub…7.6
• CVE-2026-72595A broken access control vulnerability in BadChoice Handesk a…8.1
• CVE-2026-72596A broken access control vulnerability in Ghost Foundation Gh…8.1
• CVE-2026-72597A server-side request forgery vulnerability in Friendica thr…6.5
• CVE-2026-72599An SQL injection vulnerability in e107 2.4.0 allows unauthen…9.8
• CVE-2026-7260Circular symbolic links in phar archives could lead to unbou…5.5
• CVE-2026-72600A broken access control vulnerability in Idurar IDURAR ERP C…7.5
• CVE-2026-72601A broken access control vulnerability in CSZ CMS 1.3.2 allow…7.5
• CVE-2026-72602A path traversal vulnerability in AsyncFuncAI deepwiki-open …7.5
• CVE-2026-72603An OS command injection vulnerability in wg-easy 15.3.0 allo…9.9