{"affected":[{"product":"ideon","source":"CNA: GitHub_M","vendor":"3xpyth0n","versions":[{"status":"affected","version":"< 0.9.5"}]}],"cveId":"CVE-2026-68507","cwes":["CWE-306","CWE-918"],"description":"ideon is a self-hosted visual workspace. Prior to version 0.9.5, ideon's link-preview endpoint requires no authentication at all and forwards any URL a caller supplies straight into a server-side fetch. The app does have a general-purpose SSRF guard (safeFetch/validateSafeUrl in src/app/lib/ssrf.ts), but this route sits behind no login check whatsoever, making it a fully open, anonymous URL-fetch relay - and the guard's IP blocklist itself has a gap that lets it reach the server's own loopback interface via the 0.0.0.0 \"any address\" bypass, a well-documented SSRF-filter evasion technique on Linux. This issue has been patched in version 0.9.5.","epss":{"date":"2026-11-13","percentile":0.43755,"score":0.00506},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/3xpyth0n/ideon/security/advisories/GHSA-vpc2-r395-534p"}],"kev":null,"metrics":[{"score":6.9,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":6.9,"severity":"medium","source":"NVD: security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"}],"modifiedAt":1794595666937,"publishedAt":1794430669243,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/3xpyth0n/ideon/security/advisories/GHSA-vpc2-r395-534p"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/3xpyth0n/ideon/releases/tag/v0.9.5"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/3xpyth0n/ideon/security/advisories/GHSA-vpc2-r395-534p"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/3xpyth0n/ideon/releases/tag/v0.9.5"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/3xpyth0n/ideon/security/advisories/GHSA-vpc2-r395-534p"}],"remediation":[],"revision":"b5a19ca86643057f125c699726fb3443776bdd823619cf7427f86a1855e2f273","sources":[{"modifiedAt":1794595666937,"name":"CNA: GitHub_M","retrievedAt":1794597956875,"url":"https://www.cve.org/CVERecord?id=CVE-2026-68507"},{"modifiedAt":1794521931470,"name":"NVD","retrievedAt":1794529417224,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68507"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794597979250,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-68507"}],"ssvc":{"assessedAt":1794595646116,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"ideon: Unauthenticated /api/links/preview endpoint is an open SSRF relay, and its IP blocklist misses the 0.0.0.0/:: unspecified-address bypass","updatedAt":1794597979250}