CVE-2026-68507

Severity not reported

Data quality: partial. Some fields were not provided by the source.

ideon is a self-hosted visual workspace.

ideon is a self-hosted visual workspace. Prior to version 0.9.5, ideon's link-preview endpoint requires no authentication at all and forwards any URL a caller supplies straight into a server-side fetch. The app does have a general-purpose SSRF guard (safeFetch/validateSafeUrl in src/app/lib/ssrf.ts), but this route sits behind no login check whatsoever, making it a fully open, anonymous URL-fetch relay - and the guard's IP blocklist itself has a gap that lets it reach the server's own loopback interface via the 0.0.0.0 "any address" bypass, a well-documented SSRF-filter evasion technique on Linux. This issue has been patched in version 0.9.5.

CVSS

—

Awaiting analysis by NVD

Timeline (UTC)

Published: 2026-11-11 21:16

Modified: 2026-11-11 21:16

NVD status: Received

Last synced 5 hours ago

Verified against the source API 2026-11-11 21:41 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

Not reported by the source (unknown — not "none").

Weakness classification (CWE)

CWE-306 CWE-918

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

No vendor advisory or patch reference tagged by NVD. Check the references below.

References

https://github.com/3xpyth0n/ideon/releases/tag/v0.9.5 security-advisories@github.com
https://github.com/3xpyth0n/ideon/security/advisories/GHSA-vpc2-r395-534p security-advisories@github.com

Data sources

NVD CVE API 2.0 — fetched 2026-11-11 21:41 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores