# Disclosure Notes

## Vulnerability

Authenticated blind SSRF in Matomo SiteContentDetector through attacker-controlled site `main_url`.

## Reporter

CYBER-SEC  
info@cyber-sec.si

## Public Summary

Matomo allows an authenticated site administrator to configure a site's `main_url` with an internal address. A lower-privileged authenticated user with view permission can later trigger `getTrackingMethodsForSite`, causing Matomo to perform a blind server-side HTTP request to that URL.

## Recommended Public Severity

Medium

## Recommended CVSS v3.1

`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N`

Base Score: 5.8

## Recommended CWE

- CWE-918