{"id":"CVE-2026-65967","kind":"vulnerability","aliases":["CVE-2026-65967"],"related":[],"title":"Fider: webhook URLs let admins make server fetch internal addresses","description":"Fider is a feedback portal for feature requests and suggestions. Prior to version 0.34.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Fider due to insufficient validation of webhook URLs. The application allows user-controlled URLs to be fetched by the server without restricting access to internal or external network resources. This enables attackers with administrative privileges to make arbitrary HTTP requests from the server, potentially accessing internal services or cloud metadata endpoints. This issue has been patched in version 0.34.0.","summary":"Fider is a self-hosted feedback portal, and before version 0.34.0 its webhook URL handling did not block requests to internal or cloud metadata addresses. An attacker with admin rights can make the server send HTTP requests to internal services and read cloud metadata endpoints.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fider","other","self-hosted"],"not_affected_if":["version-0.34.0-or-later"],"how_to_check":"- Check the Fider version running on the server; versions before `0.34.0` are affected.\n- Look in the admin settings for configured webhooks; unknown whether other settings expose the same path.","fix":"- Fider: upgrade to `0.34.0` or later.","status":"open","published_at":"2026-11-11T19:17:44+00:00","first_seen_at":"2026-11-11T19:28:48+00:00","triaged_at":"2026-11-11T19:30:14+00:00","updated_at":"2026-11-11T19:30:14+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-11T19:30:14Z","model":"claude-haiku-5-5","output":{"fix":"- Fider: upgrade to `0.34.0` or later.","reach":"network","title":"Fider: webhook URLs let admins make server fetch internal addresses","impact":"medium","summary":"Fider is a self-hosted feedback portal, and before version 0.34.0 its webhook URL handling did not block requests to internal or cloud metadata addresses. An attacker with admin rights can make the server send HTTP requests to internal services and read cloud metadata endpoints.","audience":"businesses","category":"other","nicknames":[],"who_cares":["fider","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"server reaches internal services and cloud metadata credentials","analyst_note":"Product ecosystem and affected-version range not in the input; confirm via the release notes link.","how_to_check":"- Check the Fider version running on the server; versions before `0.34.0` are affected.\n- Look in the admin settings for configured webhooks; unknown whether other settings expose the same path.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-0.34.0-or-later"],"who_is_affected":"Teams that self-host Fider before version 0.34.0 and let administrators configure webhooks. The sources do not say whether managed Fider hosting is affected, so the vendor's status is unknown. Instances on 0.34.0 or later are not affected by this issue.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000726,"input_tokens":4643,"output_tokens":524,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-65967':13A,16A '0.34.0':33B,81C,151C 'access':115C,137C 'address':10A,47B 'admin':5A,51B 'administr':126C 'allow':102C 'applic':101C 'arbitrari':130C 'attack':49B,124C 'block':40B 'cloud':45B,65B,141C 'control':105C 'cve':11A,14A 'due':93C 'enabl':123C 'endpoint':67B,143C 'exist':90C 'extern':119C 'featur':74C 'feedback':28B,71C 'fetch':8A,109C 'fider':1A,17B,22B,68C,92C 'forgeri':87C 'handl':37B 'host':21B,27B 'http':58B,131C 'insuffici':95C 'intern':9A,43B,61B,117C,138C 'issu':145C 'let':4A 'make':6A,54B,129C 'metadata':46B,66B,142C 'network':120C 'patch':148C 'portal':29B,72C 'potenti':136C 'prior':78C 'privileg':127C 'read':64B 'request':41B,59B,75C,86C,132C 'resourc':121C 'restrict':114C 'right':52B 'self':20B,26B 'self-host':19B,25B 'send':57B 'server':7A,56B,84C,112C,135C 'server-sid':83C 'servic':62B,139C 'side':85C 'ssrf':88C 'suggest':77C 'url':3A,36B,99C,106C 'user':104C 'user-control':103C 'valid':96C 'version':32B,80C,150C 'vulner':89C 'webhook':2A,35B,98C 'without':113C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Fider before version 0.34.0 and let administrators configure webhooks. The sources do not say whether managed Fider hosting is affected, so the vendor's status is unknown. Instances on 0.34.0 or later are not affected by this issue.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fider","high","other","selfhosted"],"campaign_type":null,"search_a":"'-2026':12A,15A '-65967':13A,16A 'address':10A 'admin':5A 'cve':11A,14A 'fetch':8A 'fider':1A 'intern':9A 'let':4A 'make':6A 'server':7A 'url':3A 'webhook':2A","search_b":"'0.34.0':33B 'address':47B 'admin':51B 'attack':49B 'block':40B 'cloud':45B,65B 'endpoint':67B 'feedback':28B 'fider':17B,22B 'handl':37B 'host':21B,27B 'http':58B 'intern':43B,61B 'make':54B 'metadata':46B,66B 'portal':29B 'read':64B 'request':41B,59B 'right':52B 'self':20B,26B 'self-host':19B,25B 'send':57B 'server':56B 'servic':62B 'url':36B 'version':32B 'webhook':35B","search_c":"'0.34.0':81C,151C 'access':115C,137C 'administr':126C 'allow':102C 'applic':101C 'arbitrari':130C 'attack':124C 'cloud':141C 'control':105C 'due':93C 'enabl':123C 'endpoint':143C 'exist':90C 'extern':119C 'featur':74C 'feedback':71C 'fetch':109C 'fider':68C,92C 'forgeri':87C 'http':131C 'insuffici':95C 'intern':117C,138C 'issu':145C 'make':129C 'metadata':142C 'network':120C 'patch':148C 'portal':72C 'potenti':136C 'prior':78C 'privileg':127C 'request':75C,86C,132C 'resourc':121C 'restrict':114C 'server':84C,112C,135C 'server-sid':83C 'servic':139C 'side':85C 'ssrf':88C 'suggest':77C 'url':99C,106C 'user':104C 'user-control':103C 'valid':96C 'version':80C,150C 'vulner':89C 'webhook':98C 'without':113C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-03T21:10:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65967","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65967","severity":null,"published_at":"2026-11-11T19:17:44+00:00","modified_at":"2026-11-11T19:17:44+00:00","first_seen_at":"2026-11-11T19:28:48+00:00","fetched_at":"2026-11-11T19:28:48+00:00","note":null}],"documents":[{"id":128152,"url":"https://github.com/getfider/fider/releases/tag/v0.34.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":128155,"url":"https://github.com/getfider/fider/security/advisories/GHSA-g445-xwm7-594r","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-03T21:10:10+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}