CVE-2026-72591 Koito - Authenticated Server-Side Request Forgery via Album Image URL Parameter

A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...

VulnCheck KEV: CVE-2020-26948

Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter...