███████╗██╗ ██╗██████╗ ██████╗ ███╗ ███╗ █████╗ ██╗ ██╗███████╗ ██╔════╝██║ ██║██╔══██╗██╔═══██╗ ████╗ ████║██╔══██╗██║ ██╔╝██╔════╝ ███████╗██║ ██║██║ ██║██║ ██║ ██╔████╔██║███████║█████╔╝ █████╗ ╚════██║██║ ██║██║ ██║██║ ██║ ██║╚██╔╝██║██╔══██║██╔═██╗ ██╔══╝ ███████║╚██████╔╝██████╔╝╚██████╔╝ ██║ ╚═╝ ██║██║ ██║██║ ██╗███████╗ ╚══════╝ ╚═════╝ ╚═════╝ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝

guest@sudomake:~/research$ cat cve-2026-40167.txt

CVE-2026-40167

Collabora OnlinecoolwsdModerate

SSRF in settings endpoints

Settings endpoints fetched any client-supplied URL server-side and returned the body. Result: read access to internal network resources.

weakness: CWE-918 · SSRF
credit: Independently discovered & credited
affected: < 25.04.9.4< 24.04.19
fixed in: 25.04.9.424.04.19

timeline

2026-04-09reported to vendor
2026-04-10CVE assigned
v25.04.9.4patch released
—advisory publication pending

◌ public advisory coming soon