{"vulnerability": "CVE-2026-108521", "sightings": [{"uuid": "67b7514a-8b9a-4fef-983e-9dd7a477d726", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108521", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117420051504863428", "content": "CVE-2026-108521 Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: \"The node API URL could be configured by an authenticated user with node-management permission and used to initiate server-side requests. [T]he report demonstrates server-side request capability but not arbitrary internal response exfiltration.\"\nhttps://www.cve.org/CVERecord?id=CVE-2026-108521https://vuldb.com/vuln/416187https://vuldb.com/vuln/416187/ctihttps://vuldb.com/cve/CVE-2026-108521https://vuldb.com/submit/893356https://gist.github.com/jovair1994/db23594d74428d38606e8000beb867d4#Studio-Saelix #Sencho#CVE_2026_108521#bot", "creation_timestamp": "2026-10-11T03:03:18.046165Z"}]}