CVE-2026-41461

CVE-2026-41461 is a blind server-side request forgery vulnerability affecting SocialEngine versions 7.8.0 and prior in the /core/link/preview endpoint, where unsanitized user input via the uri parameter allows attackers to construct arbitrary outbound HTTP requests. Authenticated remote attackers can exploit this flaw to enumerate internal network addresses and access backend services not intended for external exposure. The attack requires authentication and a moderate level of complexity, as attackers must identify valid endpoints and interpret responses indirectly due to the blind SSRF nature. The vulnerability carries a FAUCET Risk Score of 44.0/100, indicating moderate concern; however, there is no formal CVSS rating, EPSS score, or inclusion in the Known Exploited Vulnerabilities catalog at this time. Exploitation appears limited, with the vulnerability currently inactive on public threat lists and no widespread evidence of active exploitation or public exploit availability, though the architectural flaw presents a legitimate risk for vulnerable deployments.