SSRF Vulnerability in Squidex Content Management System
CVE-2026-24736

9.1CRITICAL

Key Information:

Vendor

Squidex

Status
Squidex
Vendor
CVE Published:
27 January 2026

What is CVE-2026-24736?

The Squidex content management system, an open-source headless CMS, features a critical flaw in its webhook URL handling. This vulnerability allows users to configure webhooks via the Rules engine without validating the destination IP addresses specified in the URL parameter. As a result, the system can be manipulated into making HTTP requests to any server, including local addresses, once a rule is triggered. This leads to a significant information exposure as the backend server logs the HTTP response in its execution logs, making sensitive data accessible through the API. Immediate attention is recommended, as no patched versions are currently available.

Affected Version(s)

squidex <= 7.21.0

References

https://github.com/Squidex/squidex/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.