CVE-2026-82285

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal netwo...

CVE-2026-82285

BISHENG (by dataelement ) through version 2.6.0-fix2 is affected by an unauthenticated Server-Side Request Forgery (SSRF) in the POST /api/v1/workflow/report/callback endpoint. The endpoint lacks authentication and applies no URL scheme restrictions or host filtering , allowing unauthenticated at...

CVE-2026-82285 BISHENG Unauthenticated Server-Side Request Forgery via Workflow Report Callback

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal netwo...