CVE-2026-32279: CVE-2026-32279: Server-Side Request Forgery in Connect-CMS External Page Migration

CVE-2026-32279: Server-Side Request Forgery in Connect-CMS External Page Migration Vulnerability ID: CVE-2026-32279 CVSS Score: 6.8 Published: 2026-03-23 Connect-CMS versions 1.x through 1.41.0 and 2.x through 2.41.0 contain a Server-Side Request Forgery (SSRF) vulnerability in the External Page Migration feature. Authenticated users with administrative privileges can supply malicious URLs to force the application to issue HTTP requests to arbitrary internal network resources. This allows attackers to bypass perimeter controls and interact with internal systems, loopback interfaces, or cloud provider metadata services. TL;DR An authenticated SSRF in Connect-CMS allows administrators to query internal network services and cloud metadata endpoints due to missing URL validation in the Page Migration plugin. ⚠️ Exploit Status: POC Technical Details Vulnerability Type: Server-Side Request Forgery (SSRF) CWE ID: CWE-918 CVSS v3.1 Score: 6.8 (Medium) Attack Vector: Network Privileges Required