Koel up to 9.7.0 Radio Station Creation Endpoint /api/radio/stations url server-side request forgery

Summaryinfo

A vulnerability categorized as critical has been discovered in Koel up to 9.7.0. This vulnerability affects unknown code of the file /api/radio/stations of the component Radio Station Creation Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. The identification of this vulnerability is CVE-2026-50552. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Koel up to 9.7.0 and classified as critical. This vulnerability affects an unknown functionality of the file /api/radio/stations of the component Radio Station Creation Endpoint. The manipulation of the argument url with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Koel is a free, open-source music streaming solution. Prior to version 9.7.1, Koel contains a Server-Side Request Forgery (SSRF) vulnerability in the radio station creation endpoint (POST /api/radio/stations). The url field validation rules are declared without the bail keyword, so the HasAudioContentType rule — which issues HTTP requests to the supplied URL — still executes even after the SafeUrl rule has rejected the URL as pointing to a private/reserved address. Any authenticated, non-admin user can therefore coerce the server into making HEAD/GET requests to arbitrary internal hosts. This issue has been patched in version 9.7.1.

The advisory is available at github.com. This vulnerability was named CVE-2026-50552 since 06/04/2026. The exploitation appears to be easy. The attack can be initiated remotely. Technical details are known, but there is no available exploit.

Upgrading to version 9.7.1 eliminates this vulnerability. Applying the patch 5f6ce2cefd08f437a269236b677ad971517ccbb6 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Koel

Version

• 9.0
• 9.1
• 9.2
• 9.3
• 9.4
• 9.5
• 9.6
• 9.7.0

License

• open-source

Website

• Product: https://github.com/koel/koel/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion