CVE-2026-79788

In Dradis Community Edition, the ProvidersController and AgentsController gate their adminrequired beforeaction on defined?Dradis::Pro, a constant that is never defined in CE, so the authorization check is never applied. As a result, any authenticated non-admin user can create an AI provider...

CVE-2026-79788 Dradis Community Edition 5.1.0 through 5.2.0 Server-Side Request Forgery via Unrestricted AI Provider Address

In Dradis Community Edition, the ProvidersController and AgentsController gate their adminrequired beforeaction on defined?Dradis::Pro, a constant that is never defined in CE, so the authorization check is never applied. As a result, any authenticated non-admin user can create an AI provider...