{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/fider/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:fider:fider:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-65967"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Fider (\u003c 0.34.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Fider"],"content_html":"\u003cp\u003eFider versions prior to 0.34.0 contain a Server-Side Request Forgery (SSRF) vulnerability. The application fails to properly validate user-supplied URLs within its webhook configuration feature. An attacker with administrative privileges can supply arbitrary URLs, forcing the Fider server to initiate HTTP requests to restricted internal network resources or cloud provider metadata services (e.g., IMDS). This issue is addressed in Fider version 0.34.0.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an administrative user to bypass network access controls, potentially leading to unauthorized interaction with internal services or the exfiltration of sensitive cloud instance metadata. This impacts the confidentiality and accessibility of internal network infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpgrade all Fider installations to version 0.34.0 or later immediately. As a compensating control, ensure the Fider server is deployed within a network segment that strictly limits outbound access to only required external endpoints and blocks access to internal network ranges and cloud metadata service IP addresses (e.g., 169.254.169.254).\u003c/p\u003e\n","date_modified":"2026-11-11T20:10:40Z","date_published":"2026-11-11T20:10:40Z","id":"https://feed.craftedsignal.io/briefs/2026-11-fider-ssrf-cve-2026-65967/","summary":"Fider versions before 0.34.0 are vulnerable to Server-Side Request Forgery (SSRF) in the webhook functionality, allowing authenticated administrators to perform unauthorized requests against internal network resources.","title":"Fider: Server-Side Request Forgery via webhook configuration (CVE-2026-65967)","url":"https://feed.craftedsignal.io/briefs/2026-11-fider-ssrf-cve-2026-65967/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-65840"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Fider (\u003c 0.36.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Fider"],"content_html":"\u003cp\u003eFider, a feedback portal application, is vulnerable to an authentication bypass in versions prior to 0.36.0 when deployed in multi-tenant mode (HOST_MODE=multi). An attacker can utilize a valid email verification key issued by Tenant A to authenticate as that user on Tenant B. This failure in tenant isolation allows for unauthorized account takeover across the platform. Deployments configured for single-host mode (HOST_MODE=single) are not impacted by this vulnerability.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability enables unauthorized access to user accounts on different tenants. Given the CVSS v3.1 score of 9.6, this represents a critical risk to the confidentiality and integrity of multi-tenant environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Fider to version 0.36.0 or later immediately to apply the patch for CVE-2026-65840.\u003c/li\u003e\n\u003cli\u003eReview authentication and access logs for anomalous cross-tenant login patterns or unusual account verification behavior.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T20:08:11Z","date_published":"2026-11-11T20:08:11Z","id":"https://feed.craftedsignal.io/briefs/2026-11-fider-auth-bypass-cve-2026-65840/","summary":"Fider versions prior to 0.36.0, when configured in multi-tenant mode, allow attackers to leverage an email verification key from one tenant to authenticate as that user on another, resulting in cross-tenant account takeover.","title":"Fider: Multi-tenant authentication bypass (CVE-2026-65840)","url":"https://feed.craftedsignal.io/briefs/2026-11-fider-auth-bypass-cve-2026-65840/"}],"language":"en","title":"CraftedSignal Threat Feed - Fider","version":"https://jsonfeed.org/version/1.1"}