MEDIUM 5.3 NVD
CVE-2026-123204
Posta before v0.18.0 contains a server-side request forgery vulnerability that allows authenticated users with edit rights to make the backend send POST request
Posta before v0.18.0 contains a server-side request forgery vulnerability that allows authenticated users with edit rights to make the backend send POST requests to internal destinations by creating webhooks with arbitrary URLs. Attackers can target loopback, private-network or cloud metadata addresses and read delivery status codes and error strings to probe internal hosts and ports.
References
- https://github.com/goposta/posta/blob/8c3cb6f89c8a992329fac21491c38aed70d05c73/internal/se
- https://github.com/goposta/posta/commit/6bb376b55dcfdcb979040ed42c4bf57b99e4f46a
- https://github.com/goposta/posta/issues/282
- https://github.com/goposta/posta/pull/315
- https://github.com/goposta/posta/releases/tag/v0.18.0
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-11-05 via NVD.
vulnfeed aggregates 16740 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.