Server-Side Request Forgery Vulnerability in Posta by GoPosta
CVE-2026-123204

5.3MEDIUM

Key Information:

Vendor

Goposta

Status
Posta
Vendor
CVE Published:
5 November 2026

What is CVE-2026-123204?

The vulnerability in Posta versions prior to v0.18.0 enables authenticated users with edit permissions to exploit server-side request forgery. By creating webhooks with arbitrary URLs, attackers may direct the backend to make POST requests to internal systems, including loopback and cloud metadata addresses. This malicious capability allows unauthorized probing of internal hosts, potentially leading to information disclosure through response codes and error messages.

Affected Version(s)

posta 0

References

https://github.com/goposta/posta/issues/282
issue-tracking
https://github.com/goposta/posta/pull/315
patchissue-tracking
https://github.com/goposta/posta/commit/6bb376b55dcfdcb97...
patch

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
jkaninda
.