CVE-2026-50872

Vulnerability

The vulnerability resides in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT. When selfoss runs behind a same-host reverse proxy that does not preserve forwarding headers (e.g., X-Forwarded-For or Forwarded), the AuthenticationFactory::create() method selects the Trust authentication implementation because isLocalIp() sees a loopback REMOTE_ADDR (127.0.0.1) and no forwarded address headers. This Trust implementation returns privileged decisions for read, update, and privileged checks. The affected code path is reachable via POST /source which calls Sources\Write::write() and relies on ensureIsPrivileged() before persisting a source. The attacker-controlled inputs are the source type, source parameters, and feed URL. When the submitted source title is empty, the source handling path can fetch the attacker-supplied feed URL to derive metadata [1].

Exploitation

An attacker needs network access to the selfoss instance and the deployment must be behind a same-host reverse proxy that does not set X-Forwarded-For or Forwarded headers. The attacker does not require authentication. The exploitation steps are: (1) Deploy selfoss 2.20 behind such a proxy so the application sees REMOTE_ADDR=127.0.0.1 and receives no forwarded headers. (2) From an external unauthenticated client, send POST /source with an RSS source, an empty title, and source parameters containing a URL to a listener or internal HTTP service. (3) The source creation is accepted because the authentication factory selects the trusted local implementation. (4) The listener or internal service receives a request from the selfoss server during source title or feed processing. (5) The source now exists in selfoss even though the requester did not authenticate [1].

Impact

Successful exploitation allows an unauthenticated external attacker to create privileged sources in selfoss, changing application state. Additionally, the source fetching mechanism provides a Server-Side Request Forgery (SSRF) primitive, enabling the attacker to make the selfoss server send requests to internal or external services. This can lead to information disclosure or further attacks against internal resources [1].

Mitigation

As of the publication date, no patched version of selfoss has been released. The recommended workaround is to ensure that the reverse proxy preserves and forwards the X-Forwarded-For or Forwarded headers to selfoss, so that the application can correctly distinguish between local and external requests. Deployments that already preserve these headers are not affected. No other mitigations are documented in the available references [1].