Nextcloud News is an RSS/Atom feed reader that, before version 28.3.0‑beta.1, allows authenticated users to add arbitrary feed URLs. An attacker can supply a URL that points to internal or localhost network addresses, causing the server to perform a blind server‑side HTTP request to the supplied address without returning the response to the attacker. This permits internal network scanning and probing from the host running the Nextcloud server.

The vulnerable component is the Nextcloud News app. All releases prior to 28.3.0‑beta.1 are affected; upgrading to 28.3.0‑beta.1 or later eliminates the flaw.

The CVSS score is 2.3 and the EPSS score is not available, indicating a low severity and uncertain exploitation probability. The vulnerability requires an authenticated session, so an attacker must first compromise user credentials. The flaw is not listed in CISA's KEV catalog. Once the feed URL is submitted, the attacker can discover or probe internal services that are reachable from the Nextcloud server, but cannot retrieve the response data.