SB2026111240 - Multiple vulnerabilities in Tolgee

Description

This security bulletin contains information about 2 vulnerabilities.

1) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N]

The vulnerability allows a remote user to access internal services and potentially disclose sensitive information through server-side request forgery.

The vulnerability exists due to missing checks for embedded private or loopback IPv4 addresses in Tolgee's UrlSecurity.validateUrl() when validating NAT64, 6to4, or Teredo URLs. A remote user can configure a webhook, LLM provider, or SSO endpoint with a transition-encoded URL such as http://[64:ff9b::a9fe:a9fe]/latest/meta-data/ to reach internal targets where compatible routing exists.

2) Improper Authentication (CVE-ID: N/A)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to persistently deny legitimate email owners access to accounts registered using their email addresses.

The vulnerability exists due to improper authentication in Tolgee's two-factor authentication and account recovery workflows when enabling two-factor authentication without verifying email ownership and retaining it after password resets. A remote attacker can register with a victim's email address and configure attacker-controlled two-factor authentication to prevent the victim from recovering account access even after email verification and password resets.

Remediation

Install update from vendor's website.

References

• https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-6hgf-xx56-2j3v
• https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-p5q8-2wc4-g5hg