CVE-2026-125363 · Package
NO FIX YET · SEE WHAT TO DO
MikroDash before 0.8.79 lets any signed-in user, including viewers, set notification webhook or mail destinations to internal addresses. The test endpoint then sends requests from the server, letting an attacker probe the internal network.
first public Nov 5, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run MikroDash on a server reachable by their staff, where any signed-in account (including read-only viewer accounts) can create notification channels. Instances used only by a single trusted admin, or not running notification channels, carry less exposure. unknown for exact configuration conditions beyond this.
Not affected if auth-required, no-notification-channels
Who cares dashboards, mikrodash, self-hosted
0.8.79POST /api/notify-channels/{id}/test endpoint in your deployment0.8.79 or laterMikroDash before 0.8.79 contains a server-side request forgery vulnerability that allows any signed-in user, including the viewer role, to target internal addresses through notification channels. Attackers can set webhook or mail destinations to loopback, LAN or link-local addresses and call POST /api/notify-channels/{id}/test to probe the internal network.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.