Search

Find a vulnerability

Search criteria

    2 vulnerabilities by goposta

    CVE-2026-123204 (GCVE-0-2026-123204)

    Vulnerability from nvd – Published: 2026-11-05 18:16 – Updated: 2026-11-05 18:16
    VLAI
    Title
    Posta before v0.18.0 SSRF via Webhook URL
    Summary
    Posta before v0.18.0 contains a server-side request forgery vulnerability that allows authenticated users with edit rights to make the backend send POST requests to internal destinations by creating webhooks with arbitrary URLs. Attackers can target loopback, private-network or cloud metadata addresses and read delivery status codes and error strings to probe internal hosts and ports.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
    CWE
    • CWE-918 - Server-Side Request Forgery (SSRF)
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 7423 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    goposta posta Affected: 0 , < v0.18.0 (custom)
    		Create a notification for this product.
    Date Public
    2026-10-30 00:00
    Credits
    George Chen jkaninda
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/goposta/posta",
          "product": "posta",
          "repo": "https://github.com/goposta/posta",
          "vendor": "goposta",
          "versions": [
            {
              "lessThan": "v0.18.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "jkaninda"
        }
      ],
      "datePublic": "2026-10-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Posta before v0.18.0 contains a server-side request forgery vulnerability that allows authenticated users with edit rights to make the backend send POST requests to internal destinations by creating webhooks with arbitrary URLs. Attackers can target loopback, private-network or cloud metadata addresses and read delivery status codes and error strings to probe internal hosts and ports."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T18:16:39.804Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/goposta/posta/issues/282"
        },
        {
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/goposta/posta/pull/315"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/goposta/posta/commit/6bb376b55dcfdcb979040ed42c4bf57b99e4f46a"
        },
        {
          "name": "posta v0.18.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/goposta/posta/releases/tag/v0.18.0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/goposta/posta/blob/8c3cb6f89c8a992329fac21491c38aed70d05c73/internal/services/webhook/dispatcher.go#L321-L338"
        },
        {
          "name": "VulnCheck Advisory: Posta before v0.18.0 SSRF via Webhook URL",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/posta-before-0.18.0-ssrf-via-webhook-url"
        }
      ],
      "title": "Posta before v0.18.0 SSRF via Webhook URL",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-123204",
    "datePublished": "2026-11-05T18:16:39.804Z",
    "dateReserved": "2026-11-05T17:58:51.242Z",
    "dateUpdated": "2026-11-05T18:16:39.804Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-123204 (GCVE-0-2026-123204)

    Vulnerability from cvelistv5 – Published: 2026-11-05 18:16 – Updated: 2026-11-05 18:16
    VLAI
    Title
    Posta before v0.18.0 SSRF via Webhook URL
    Summary
    Posta before v0.18.0 contains a server-side request forgery vulnerability that allows authenticated users with edit rights to make the backend send POST requests to internal destinations by creating webhooks with arbitrary URLs. Attackers can target loopback, private-network or cloud metadata addresses and read delivery status codes and error strings to probe internal hosts and ports.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
    CWE
    • CWE-918 - Server-Side Request Forgery (SSRF)
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 7423 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    goposta posta Affected: 0 , < v0.18.0 (custom)
    		Create a notification for this product.
    Date Public
    2026-10-30 00:00
    Credits
    George Chen jkaninda
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/goposta/posta",
          "product": "posta",
          "repo": "https://github.com/goposta/posta",
          "vendor": "goposta",
          "versions": [
            {
              "lessThan": "v0.18.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "jkaninda"
        }
      ],
      "datePublic": "2026-10-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Posta before v0.18.0 contains a server-side request forgery vulnerability that allows authenticated users with edit rights to make the backend send POST requests to internal destinations by creating webhooks with arbitrary URLs. Attackers can target loopback, private-network or cloud metadata addresses and read delivery status codes and error strings to probe internal hosts and ports."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T18:16:39.804Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/goposta/posta/issues/282"
        },
        {
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/goposta/posta/pull/315"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/goposta/posta/commit/6bb376b55dcfdcb979040ed42c4bf57b99e4f46a"
        },
        {
          "name": "posta v0.18.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/goposta/posta/releases/tag/v0.18.0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/goposta/posta/blob/8c3cb6f89c8a992329fac21491c38aed70d05c73/internal/services/webhook/dispatcher.go#L321-L338"
        },
        {
          "name": "VulnCheck Advisory: Posta before v0.18.0 SSRF via Webhook URL",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/posta-before-0.18.0-ssrf-via-webhook-url"
        }
      ],
      "title": "Posta before v0.18.0 SSRF via Webhook URL",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-123204",
    "datePublished": "2026-11-05T18:16:39.804Z",
    "dateReserved": "2026-11-05T17:58:51.242Z",
    "dateUpdated": "2026-11-05T18:16:39.804Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}