An authenticated user can trigger the server to make GET requests to any URL supplied via the scanFeeds GraphQL query, because the resolver lacks address validation. The server then parses the response as a feed or HTML and returns only URL, title, description, and type fields. This allows an attacker to probe internal network endpoints, discover services, and potentially read metadata about internal resources. No arbitrary code execution is possible, but the exposure of internal URLs and the ability to cause the server to contact internal services could be leveraged in chain attacks or for reconnaissance.

The vulnerability exists in the Omnivore application provided by omnivore-app. The resolver resides in packages/api/src/resolvers/subscriptions/index.ts. Version information is not specified, so all current and future releases before a fix are potentially affected. Users should review their Omnivore deployment for the presence of scanFeeds and confirm the vulnerability exists.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation. The attack requires authentication and the ability to invoke the scanFeeds query. While the impact is limited to metadata disclosure and the ability to probe ports, an attacker could use this information to target internal services that may have other vulnerabilities. The overall risk is moderate, but active mitigation is recommended.