CVE-2026-3789 - Vulnerability Analysis
MediumCVSS: 6.3Last Updated: March 10, 2026
Bytedesk - Server Side Request Forgery
Published: March 9, 2026Updated: March 10, 2026PoC AvailableRemote Exploitable
Overview
Bytedesk <= 1.3.9 contains a server-side request forgery caused by manipulation of the "apiUrl" argument in SpringAIGiteeRestController's getModels function, letting remote attackers make arbitrary requests, exploit requires no special privileges.
Severity & Score
Severity: Medium
CVSS Score: 6.3
Impact
Remote attackers can make arbitrary requests from the server, potentially accessing internal resources or sensitive data.
Mitigation
Upgrade to version 1.4.5.4.
References
- https://github.com/Bytedesk/bytedesk/issues/21
- https://vuldb.com/?ctiid.349756
- https://github.com/Bytedesk/bytedesk/commit/975e39e4dd527596987559f56c5f9f973f64eff7
- https://github.com/Bytedesk/bytedesk/issues/21#issue-3993531226
- https://github.com/Bytedesk/bytedesk/issues/21#issuecomment-3976672522
- https://github.com/Bytedesk/bytedesk/releases/tag/v1.4.5.4
- https://vuldb.com/?id.349756
- https://vuldb.com/?submit.768044
- https://github.com/Bytedesk/bytedesk/
Related Resources
Details
- CVE ID
- CVE-2026-3789
- Severity
- Medium
- CVSS Score
- 6.3
- Type
- server_side_request_forgery
- Status
- confirmed
CWE
- CWE-918
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L