CVE-2026-50888: An authenticated Server-Side Request Forgery (SSRF) in the custom scraper subsystem component of Benjamin Jonard Koillection v1

Synopsis

Server-Side Request Forgery (SSRF) is present in the custom scraper subsystem of Koillection v1.8.0. The vulnerability is reachable over the network by any authenticated user with a low-privilege account, requiring no victim interaction. A successful attacker can make the server issue arbitrary HTTP requests to internal network resources, exposing sensitive internal data and enabling modification of internal services that accept unauthenticated inbound requests. HarborGuard is tracking the advisory for patch availability, as no fix version has been published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Koillection service over the network; the component is network-exposed by design.

• AuthenticationRequired

  Any low-privilege account is sufficient; no administrative or elevated credentials are needed.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker submits a crafted URL directly to the scraper endpoint.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or specific memory layout is required.

Blast Radius

• The attacker can force the server to issue HTTP requests to arbitrary internal addresses, effectively using the Koillection host as a proxy to map internal network topology and enumerate live services.
• Internal services that trust inbound requests from the application host (such as metadata APIs, internal dashboards, or unauthenticated microservices) can have their data read or their state modified.
• Sensitive credentials, tokens, or configuration data served by internal endpoints (for example, cloud instance metadata at 169.254.169.254) are readable by the attacker through the SSRF responses.
• Data integrity of internal services that accept write operations over HTTP is at risk, as the attacker can craft URLs that trigger state-changing requests on those services.