CVE-2026-76203
MediumCVSS 5.1Summary
In maalfer Pentestify versions 1.2.0 through 2.3.2, there is a vulnerability due to incorrect behavior order (validate before canonicalize) in the report theme CSS sanitizer. An authenticated user can force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that reconstruct the url() function and evade the sanitizer blocklist.
Risk Assessment
An attacker can use other users' browsers to send HTTP requests, potentially leading to disclosure of sensitive user information (IP, User-Agent) and possibly further attacks.
Recommendation
Upgrade Pentestify to a version newer than 2.3.2, where this vulnerability is fixed.
Original NVD description (English source)
Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that reconstruct the url() function and evade the sanitizer blocklist