CVE-2026-68507

ideon is a self-hosted visual workspace. Prior to version 0.9.5, ideon's link-preview endpoint requires no authentication at all and forwards any URL a caller supplies straight into a server-side fetch. The app does have a general-purpose SSRF guard safeFetch/validateSafeUrl in src/app/lib/ssrf.t...