CVE-2026-77164 Details
Description
Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST /apps/circles/event/ and POST /apps/circles/incoming/ reach this code path, allowing any unauthenticated user to force the server to issue a GET request to an internal address. The response body of the internal request is never returned to the requester, so this is blind SSRF: an attacker can determine whether an internal service is reachable, but cannot read its response contents through this endpoint alone.
A blind server-side request forgery (SSRF) vulnerability has been identified in the Nextcloud Circles app. This issue arises because the app's remote-instance signature verification process fetches an attacker-supplied keyId URL before establishing trust in the remote instance. Additionally, it allows requests to local or private addresses, bypassing Nextcloud's core SSRF protections. The vulnerability is present in Circles versions prior to the November 2025 maintenance release. Exploitation is possible through the public, unauthenticated endpoints POST /apps/circles/event/ and POST /apps/circles/incoming/, which can be used to send requests to internal addresses via blind SSRF.
The Circles app has been updated in the November 2025 maintenance release to address this vulnerability. Users should ensure they are running this version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackerone.com/reports/3303283 | [email protected] | ExploitIssue TrackingTechnical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Circles | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |