CVE-2026-79788: In Dradis Community Edition, the ProvidersController and AgentsController gate their admin_required before_action on `de

Dradis Community Edition has a broken authorization check in its ProvidersController and AgentsController because they check for a constant that never exists, allowing any logged-in non-admin user to create fake AI providers pointing to arbitrary websites. When triggered, the server makes requests to these attacker-controlled URLs (SSRF, or server-side request forgery, where a server is tricked into making requests to unintended targets) and leaks the responses back to the attacker through error messages.