CVE-2026-100893 in VoceChat Server
Summary
by MITRE • 09/28/2026
A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. This vulnerability affects the function open_graph::fetch of the file src/api/resource.rs of the component open_graphic_parse Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/28/2026
The Privoce VoceChat Server, specifically versions up to 0.5.36, contains a critical server-side request forgery vulnerability within its open graph parsing functionality. This flaw is located in the fetch function of the src/api/resource.rs file, which handles requests for the open_graphic_parse endpoint. The core technical issue stems from insufficient validation and sanitization of user-supplied input passed as the url argument. When an attacker provides a maliciously crafted URL to this endpoint, the server processes it without adequately verifying whether the target resource is internal or external. This lack of restriction allows the application to act as a proxy for arbitrary network requests initiated by the client rather than solely fetching metadata from intended public web pages.
This vulnerability aligns with CWE-918, which describes Server-Side Request Forgery (SSRF), where a vulnerable server makes HTTP requests on behalf of an attacker without proper validation of the destination URL. The operational impact is significant because it enables remote attackers to interact with internal services that are not directly accessible from the external network. By leveraging this flaw, an adversary can probe internal infrastructure, access sensitive data stored in local databases or configuration files via file protocols, or exploit other vulnerabilities within backend systems such as cloud metadata endpoints like AWS EC2 instance metadata service 169.254.169.254. This capability effectively bypasses network perimeter defenses since the requests originate from a trusted internal server IP address.
From an offensive security perspective, this vulnerability maps to MITRE ATT&CK technique T1071, Application Layer Protocol, specifically under web protocols where attackers use legitimate application functions to facilitate lateral movement or data exfiltration. The fact that the exploit has been publicly disclosed and is known to be functional increases the risk profile substantially, as automated scanning tools may already target this specific version of VoceChat Server for exploitation attempts. Despite early notification by security researchers regarding this disclosure, the vendor did not respond, leaving users with no official patch or mitigation guidance from the original developers during a critical window of exposure.
To mitigate this vulnerability in environments where upgrading is not immediately feasible, administrators should implement strict input validation on all URL parameters passed to the open_graphic_parse endpoint. This includes enforcing allowlists for permitted domains and protocols while explicitly blocking private IP ranges, loopback addresses, and cloud metadata endpoints at either the application level or via a reverse proxy configuration such as Nginx or Apache. Additionally, deploying web application firewalls with SSRF detection rules can help identify and block malicious requests before they reach the vulnerable function. Given the lack of vendor support, organizations relying on this software should consider migrating to alternative chat solutions that maintain active security maintenance cycles and adhere to secure coding standards for external resource fetching operations.