Executive brief
A vulnerability in the selfoss RSS aggregator allows unauthenticated attackers to bypass security controls and perform administrative actions. By sending specially crafted web requests, an attacker can trick the system into thinking the request is coming from a trusted internal source. This can lead to the unauthorized creation of data sources, exposure of sensitive internal information, and potential command execution, depending on the server configuration.
Technical details
The vulnerability exists in the AuthenticationFactory::create() method of selfoss v2.20-SNAPSHOT. When the application is deployed behind a same-host reverse proxy that does not preserve forwarding headers (like X-Forwarded-For), the isLocalIp() check may incorrectly identify external traffic as originating from the loopback address (127.0.0.1). This causes the application to default to a 'Trust' authentication state, granting the requester privileged access. An attacker can exploit this to reach the Sources\Write::write() path via a POST request to /source, enabling the creation of malicious sources and triggering Server-Side Request Forgery (SSRF) when the application attempts to fetch metadata from attacker-controlled URLs. In certain configurations, this may lead to arbitrary command execution.
Affected products
- fossar selfoss 2.20-SNAPSHOT
Timeline
- 2026-06-13: disclosed: Initial disclosure via GitHub Gist by pyuysig
- 2026-06-15: advisory: CVE-2026-50872 published by NVD/MITRE