CVE-2026-108594

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-108594

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108594.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-108594

Published

2026-10-10T18:16:57Z

Modified

2026-10-12T02:31:16Z

Severity

2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N CVSS Calculator

Summary

Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch

Details

Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports on the provider's internal address on each login.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-918"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108594.json"
}

References

Affected packages

Git / github.com/mealie-recipes/mealie

Affected ranges

Type

GIT

Repo

https://github.com/mealie-recipes/mealie

Events

Introduced

84b2677f76069a6fb2bac6e2c633c9dbe7379ce4

Fixed

0552eaa4a80031b8572849cca0ed95d07f1be001

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "3.26.0"
        },
        {
            "last_affected":  "3.28.0"
        },
        {
            "fixed":  "3.28.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v3.*

v3.26.0

v3.27.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108594.json"