CVE-2026-28508

CVE-2026-28508 is a critical vulnerability affecting Idno social publishing platforms prior to version 1.6.4. It stems from a logic error in the API authentication, allowing unauthenticated attackers to bypass CSRF protection on the URL unfurl service. This bypass, combined with the lack of a login requirement, enables attackers to force the server to make arbitrary outbound HTTP requests, potentially accessing internal network resources or cloud metadata services and retrieving their content. The vulnerability carries a CVSS score of 9.2 (CRITICAL), indicating a severe risk with a network attack vector, low attack complexity, and no user interaction required. The potential impact is high for confidentiality, as attackers can retrieve sensitive information from internal systems. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness at this time.