CVE-2026-72598

MEDIUM 6.5

Apioo Fusio - Server-Side Request Forgery

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax via FILTER_VALIDATE_URL but applies no IP or host denylist. When the registered event fires, the server issues an HTTP POST to the attacker-supplied internal URL.

CWE	CWE-918
Vendor	apioo
Product	fusio
Published	Aug 11, 2026

Stay Ahead of the Next One

Get instant alerts for apioo fusio

Be the first to know when new medium vulnerabilities affecting apioo fusio are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Apioo / Fusio

0 ≤ 8.8.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/apioo/fusio

Credits

Bobur Abdugafforov