Grimoire prior to version 1.0.0 contains an unauthenticated server‑side request forgery in its /api/fetch‑metadata endpoint. The handler forwards user‑supplied URLs to getMetadata() without performing any authentication checks. An attacker can therefore request arbitrary internal or loopback resources, and the service returns parsed title, description and page content, enabling sensitive data disclosure.

The vulnerability affects the Grimoire project developed by goniszewski, specifically any deployment of Grimoire before the 1.0.0 release. No specific sub‑versions are listed, so all releases older than 1.0.0 should be considered vulnerable.

With a CVSS score of 6.9 the vulnerability represents moderate risk. The EPSS score is not available and the issue is not listed in CISA's KEV catalog, suggesting no widespread exploitation yet. However, because the SSRF is unauthenticated and targets internal or cloud metadata endpoints, a threat actor could potentially exfiltrate internal configuration or credentials if the target service hosts sensitive data. The attack can be performed remotely with a simple HTTP request to the /api/fetch‑metadata POST endpoint.