A vulnerable SSRF implementation has been discovered in the link-preview endpoint of Friendica’s 2026.08-dev branch. The endpoint blindly follows any URL supplied by an authenticated user, regardless of whether the address is internal. An attacker holding a free self‑registered account can thus request internal network services or cloud metadata endpoints, potentially gaining sensitive information or facilitating further attacks. The flaw represents a remote server‑side request forgery (CWE‑918) that can lead to unauthorized data disclosure or privilege escalation within the internal network.

Friendica software, version 2026.08-dev and earlier, specifically any instance that has not applied the corrective update from the Friendica developers. The vulnerability applies to all installations where the link‑preview feature is enabled and does not discriminate between user roles beyond requiring authentication. Only the free self‑registered user tier is initially required, making the attack readily available to a broad user base.

The CVSS score of 6.5 indicates a moderate severity risk, but the absence of an EPSS score and the lack of listing in the CISA KEV catalog suggest limited known exploitation at this time. However, because the flaw is exploitable by authenticated users, an attacker with a valid account can repeatedly probe network topology, serving as a foothold for later attacks. The attack vector is inferred to be through the public link‑preview API, and successful exploitation requires only that the target host resolvable by the Friendica instance. Enabling additional logging or blocking internal requests would reduce the risk until a patch becomes available.