{"id":"CVE-2026-123204","kind":"vulnerability","aliases":["CVE-2026-123204"],"related":[],"title":"Posta: webhook URLs let authenticated editors probe internal hosts","description":"Posta before v0.18.0 contains a server-side request forgery vulnerability that allows authenticated users with edit rights to make the backend send POST requests to internal destinations by creating webhooks with arbitrary URLs. Attackers can target loopback, private-network or cloud metadata addresses and read delivery status codes and error strings to probe internal hosts and ports.","summary":"Posta before v0.18.0 lets a logged-in user with edit rights create webhooks pointing at arbitrary URLs, and the server sends POST requests to them. An attacker can aim these at loopback, private-network or cloud metadata addresses and read status codes and error strings to map internal hosts and ports.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","posta","self-hosted","webhooks"],"not_affected_if":["managed-hosting","version-0.18.0-or-later"],"how_to_check":"- Confirm the Posta version in use, for example with `posta --version` or the image tag, and check whether it is below `0.18.0`\n- Review which accounts hold edit rights in Posta and whether webhook creation is open to them","fix":"- Posta: upgrade to `0.18.0` or later","status":"open","published_at":"2026-11-05T19:17:19+00:00","first_seen_at":"2026-11-05T19:40:36+00:00","triaged_at":"2026-11-05T19:43:29+00:00","updated_at":"2026-11-05T19:43:29+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T19:43:29Z","model":"claude-haiku-5-5","output":{"fix":"- Posta: upgrade to `0.18.0` or later","reach":"network","title":"Posta: webhook URLs let authenticated editors probe internal hosts","impact":"medium","summary":"Posta before v0.18.0 lets a logged-in user with edit rights create webhooks pointing at arbitrary URLs, and the server sends POST requests to them. An attacker can aim these at loopback, private-network or cloud metadata addresses and read status codes and error strings to map internal hosts and ports.","audience":"businesses","category":"package","nicknames":[],"who_cares":["posta","self-hosted","webhooks"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"internal hosts and ports are probed; cloud metadata may be reachable","analyst_note":"","how_to_check":"- Confirm the Posta version in use, for example with `posta --version` or the image tag, and check whether it is below `0.18.0`\n- Review which accounts hold edit rights in Posta and whether webhook creation is open to them","plain_action":"","needs_analyst":false,"not_affected_if":["version-0.18.0-or-later","managed-hosting"],"who_is_affected":"Teams that self-host Posta before v0.18.0 and let more than a small set of trusted users edit workspaces. The server has to be able to reach internal networks or cloud metadata endpoints for the probe to return useful data. Deployments on v0.18.0 or later, or where only trusted administrators can create webhooks, are lower risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00071,"input_tokens":4293,"output_tokens":561,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123204':12A,15A '-2026':11A,14A 'address':61B,119C 'aim':51B 'allow':87C 'arbitrari':38B,107C 'attack':49B,109C 'authent':5A,88C 'backend':96C 'cloud':59B,117C 'code':65B,124C 'contain':78C 'creat':34B,104C 'cve':10A,13A 'deliveri':122C 'destin':102C 'edit':32B,91C 'editor':6A 'error':67B,126C 'forgeri':84C 'host':9A,20B,72B,131C 'intern':8A,71B,101C,130C 'let':4A,25B 'log':28B 'logged-in':27B 'loopback':54B,112C 'make':94C 'map':70B 'metadata':60B,118C 'network':57B,115C 'packag':16B 'point':36B 'port':74B,133C 'post':44B,98C 'posta':1A,17B,22B,75C 'privat':56B,114C 'private-network':55B,113C 'probe':7A,129C 'read':63B,121C 'request':45B,83C,99C 'right':33B,92C 'self':19B 'self-host':18B 'send':43B,97C 'server':42B,81C 'server-sid':80C 'side':82C 'status':64B,123C 'string':68B,127C 'target':111C 'url':3A,39B,108C 'user':30B,89C 'v0.18.0':24B,77C 'vulner':85C 'webhook':2A,21B,35B,105C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Posta before v0.18.0 and let more than a small set of trusted users edit workspaces. The server has to be able to reach internal networks or cloud metadata endpoints for the probe to return useful data. Deployments on v0.18.0 or later, or where only trusted administrators can create webhooks, are lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","posta","selfhosted","webhooks"],"campaign_type":null,"first_public_at":"2026-11-05T19:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123204","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123204","severity":null,"published_at":"2026-11-05T19:17:19+00:00","modified_at":"2026-11-05T19:17:19+00:00","first_seen_at":"2026-11-05T19:40:36+00:00","fetched_at":"2026-11-05T19:40:36+00:00","note":null}],"documents":[{"id":79202,"url":"https://github.com/goposta/posta/commit/6bb376b55dcfdcb979040ed42c4bf57b99e4f46a","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79203,"url":"https://github.com/goposta/posta/releases/tag/v0.18.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79204,"url":"https://www.vulncheck.com/advisories/posta-before-0.18.0-ssrf-via-webhook-url","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}