MEDIUMCVSS v3.1 4.3Vulnerability
CVE-2026-123204
Posta before v0.18.0 contains a server-side request forgery vulnerability that allows authenticated users with edit rights to make the backend send POST requests to internal destinations by creating webhooks with arbitrary URLs. Attackers can target loopback, private-network or cloud metadata addresses and read delivery status codes and error strings to probe internal hosts and ports.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-06T06:16:30.423848+00:00
- Cvss severity
- MEDIUM
- Cvss score
- 4.3
- Retrieved at
- 2026-11-06T06:17:09+00:00
- Score
- 4.3
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-123204
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- First seen by Signal
- 2026-11-05T22:06:44+00:00
- Name
- CVE-2026-123204
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Published at
- 2026-11-05T19:17:19.693
- Last modified
- 2026-11-05T19:17:19.693
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph