CVE-2026-123204

EUVD-2026-117649
Posta before v0.18.0 contains a server-side request forgery vulnerability that allows authenticated users with edit rights to make the backend send POST requests to internal destinations by creating webhooks with arbitrary URLs. Attackers can target loopback, private-network or cloud metadata addresses and read delivery status codes and error strings to probe internal hosts and ports.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/goposta/posta/blob/8c3cb6f89c8a992329fac21491c38aed70d05c73/internal/services/webhook/dispatcher.go#L321-L338
https://github.com/goposta/posta/commit/6bb376b55dcfdcb979040ed42c4bf57b99e4f46a
https://github.com/goposta/posta/issues/282
https://github.com/goposta/posta/pull/315
https://github.com/goposta/posta/releases/tag/v0.18.0
https://www.vulncheck.com/advisories/posta-before-0.18.0-ssrf-via-webhook-url