SB20261110233 - Time-of-check Time-of-use (TOCTOU) Race Condition in Tolgee

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261110233

SB20261110233 - Time-of-check Time-of-use (TOCTOU) Race Condition in Tolgee

Published: November 10, 2026

Security Bulletin ID SB20261110233
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: N/A)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to access internal services and cloud metadata endpoints and disclose configured API keys or webhook payloads through server-side request forgery.

The vulnerability exists due to a time-of-check time-of-use race condition in Tolgee's UrlSecurity validation and LLM provider and webhook request handling when outbound requests independently resolve previously validated hostnames. A remote user can save a URL resolving to a public address, change its DNS records to an internal address, and trigger an LLM request or webhook execution to redirect requests and sensitive data to that address.


Remediation

Install update from vendor's website.

References