According to the revised description, the Koito photo‑management application (v0.3.2) contains a server‑side request forgery flaw that allows an authenticated user to send a PATCH request to /apis/web/v1/album/{id}/image and supply a crafted image_url value. The server downloads the specified URL without validating the host, enabling the attacker to force HTTP requests to arbitrary internal or external addresses, thereby potentially leaking sensitive data or serving as an entry point for further compromise. This is a classic example of CWE‑918.

Koito by gabehf is affected when running version 0.3.2 and earlier; the vulnerability is confined to the web API that updates album images. No other product or version is listed as susceptible.

The CVSS score of 7.7 signals high severity. EPSS is not available, and the flaw is not listed in CISA KEV, indicating no known active exploits yet. Based on the updated description, it is inferred that the attacker must be authenticated; the vulnerable endpoint accepts a crafted image_url in an authenticated PATCH request, forcing the server to perform requests to any host, including internal ones, which could leak data or serve as an attack surface for lateral movement.