CVE-2026-40089

Sonicverse, a self-hosted Docker Compose stack for live radio streaming, contains a Server-Side Request Forgery (SSRF) vulnerability in its dashboard API client (apps/dashboard/lib/api.ts). The vulnerability affects installations deployed using the provided install.sh script, where the dashboard accepts user-controlled URLs and passes them directly to a server-side HTTP client without adequate validation. An authenticated operator can exploit this flaw to make arbitrary HTTP requests from the dashboard backend to internal or external systems. The vulnerability carries a CVSS 3.1 severity rating of 9.9 (Critical), with a network-based attack vector, low complexity, and low privilege requirements. The attack has a changed scope impact, resulting in high confidentiality and integrity compromise, along with low availability impact. This combination of factors makes the vulnerability particularly concerning as an authenticated user could potentially access sensitive internal resources or compromise connected systems. There is no evidence of active exploitation in the wild, and the vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 0.000430 indicates minimal real-world exploitation probability. The patch is available via commit cb1ddbacafcb441549fe87d3eeabdb6a085325e4, and operators should prioritize updating their Sonicverse installations to remediate this risk.