{"id":"CVE-2026-121431","kind":"vulnerability","aliases":["CVE-2026-121431"],"related":[],"title":"AzuraCast: station users can reach internal services through webhook connectors","description":"AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass the UserUrlFilter guard via the Mastodon, Telegram, GroupMe, and RadioReg connectors. Attackers can set instance_url, api, or webhookurl to internal addresses and trigger the webhook test endpoint to reach loopback, private-network, or cloud-metadata services.","summary":"AzuraCast before 0.24.0 lets station users with WebHooks permission bypass its URL filter through the Mastodon, Telegram, GroupMe and RadioReg connectors. An attacker can point these settings at loopback, private-network or cloud-metadata addresses and read what those services return.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["azuracast","package","self-hosted","web-radio"],"not_affected_if":["no-webhook-permission-users","version-0.24.0-or-later"],"how_to_check":"- Check the AzuraCast version in the installed release; affected versions are those before `0.24.0`.\n- Look for station users who hold the WebHooks permission, since only they can reach the flaw.","fix":"- Upgrade AzuraCast to `0.24.0` or later.","status":"open","published_at":"2026-11-03T15:17:34+00:00","first_seen_at":"2026-11-03T15:21:59+00:00","triaged_at":"2026-11-03T15:23:13+00:00","updated_at":"2026-11-03T15:23:13+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T15:23:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade AzuraCast to `0.24.0` or later.","reach":"network","title":"AzuraCast: station users can reach internal services through webhook connectors","impact":"medium","summary":"AzuraCast before 0.24.0 lets station users with WebHooks permission bypass its URL filter through the Mastodon, Telegram, GroupMe and RadioReg connectors. An attacker can point these settings at loopback, private-network or cloud-metadata addresses and read what those services return.","audience":"businesses","category":"package","nicknames":[],"who_cares":["azuracast","self-hosted","web-radio"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads internal services and cloud metadata credentials from the server","analyst_note":"","how_to_check":"- Check the AzuraCast version in the installed release; affected versions are those before `0.24.0`.\n- Look for station users who hold the WebHooks permission, since only they can reach the flaw.","plain_action":"","needs_analyst":false,"not_affected_if":["version-0.24.0-or-later","no-webhook-permission-users"],"who_is_affected":"Only AzuraCast instances older than 0.24.0 where station users hold the WebHooks permission and can use the Mastodon, Telegram, GroupMe or RadioReg connectors. Instances where only trusted administrators have webhook access are lower risk, but the sources do not say whether the flaw is reachable from outside the network.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000698,"input_tokens":4213,"output_tokens":554,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121431':13A,16A '-2026':12A,15A '0.24.0':27B,70C 'address':61B,109C 'allow':80C 'api':104C 'attack':47B,99C 'azuracast':1A,17B,25B,68C 'bypass':34B,87C 'cloud':59B,124C 'cloud-metadata':58B,123C 'connector':10A,45B,98C 'contain':71C 'cve':11A,14A 'endpoint':115C 'filter':37B 'forgeri':77C 'groupm':42B,95C 'guard':90C 'host':21B 'instanc':102C 'intern':6A,108C 'let':28B 'loopback':53B,118C 'mastodon':40B,93C 'metadata':60B,125C 'network':56B,121C 'packag':18B 'permiss':33B,85C 'point':49B 'privat':55B,120C 'private-network':54B,119C 'radio':24B 'radioreg':44B,97C 'reach':5A,117C 'read':63B 'request':76C 'return':67B 'self':20B 'self-host':19B 'server':74C 'server-sid':73C 'servic':7A,66B,126C 'set':51B,101C 'side':75C 'station':2A,29B,81C 'telegram':41B,94C 'test':114C 'trigger':111C 'url':36B,103C 'user':3A,30B,82C 'userurlfilt':89C 'via':91C 'vulner':78C 'web':23B 'web-radio':22B 'webhook':9A,32B,84C,113C 'webhookurl':106C","nicknames":[],"mitigations":[],"who_affected":"Only AzuraCast instances older than 0.24.0 where station users hold the WebHooks permission and can use the Mastodon, Telegram, GroupMe or RadioReg connectors. Instances where only trusted administrators have webhook access are lower risk, but the sources do not say whether the flaw is reachable from outside the network.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["azuracast","medium","package","selfhosted","webradio"],"first_public_at":"2026-10-18T15:58:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121431","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121431","severity":null,"published_at":"2026-11-03T15:17:34+00:00","modified_at":"2026-11-03T15:17:34+00:00","first_seen_at":"2026-11-03T15:21:59+00:00","fetched_at":"2026-11-03T15:21:59+00:00","note":null}],"documents":[{"id":58387,"url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-qh22-76gf-qwc4","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-18T15:58:32+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":58388,"url":"https://www.vulncheck.com/advisories/azuracast-before-0.24.0-ssrf-filter-bypass-via-webhook-connectors","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}