CVE-2026-103980

ideon is a self-hosted visual workspace. Prior to version 0.9.6, the SSRF protection in safeFetch is bypassed by IPv6 transition addresses that embed private IPv4 addresses. The isPrivateIP function in src/app/lib/ssrf.ts checks only a narrow set of IPv6 ranges loopback ::1, ULA fc/fd, link-local...

CVE-2026-68507

ideon is a self-hosted visual workspace. Prior to version 0.9.5, ideon's link-preview endpoint requires no authentication at all and forwards any URL a caller supplies straight into a server-side fetch. The app does have a general-purpose SSRF guard safeFetch/validateSafeUrl in src/app/lib/ssrf.t...

CVE-2026-65968

ideon is a self-hosted visual workspace. Prior to version 0.9.4, validateUrlForSSRF / safeFetch in lib/oauth/ssrf-protection.ts and the parallel validateMcpUrl in lib/security/validators.ts perform SSRF host-blocking by string/regex matching on new URLurl.hostname. Their IPv6 branch only recognis...

CVE-2026-65965

ideon is a self-hosted visual workspace. Prior to version 0.9.4, several project mutation endpoints under /api/projects/id/ resolve the caller's project role but never enforce it, so a user who was granted only the read-only viewer role on a project can perform write operations on that project. T...