CVE-2026-123204
Last modified
CVE-2026-123204 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. Posta before v0.18.0 contains a server-side request forgery vulnerability that allows authenticated users with edit rights to make the backend send POST requests to internal destinations by creating webhooks with arbitrary URLs. Attackers can target loopback, private-network or cloud metadata addresses and read delivery status codes and error strings to probe internal hosts and ports..
Description
Posta before v0.18.0 contains a server-side request forgery vulnerability that allows authenticated users with edit rights to make the backend send POST requests to internal destinations by creating webhooks with arbitrary URLs. Attackers can target loopback, private-network or cloud metadata addresses and read delivery status codes and error strings to probe internal hosts and ports.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| goposta | posta | < v0.18.0 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-123204?
How severe is CVE-2026-123204?
How do I fix CVE-2026-123204?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-1232A medium-severity vulnerability has been identified in Beyon…6.8
- CVE-2026-12320Information disclosure in the Password Manager component. Th…4.3
- CVE-2026-123200VRPN through 07.36 contains an out-of-bounds stack write vul…7.5
- CVE-2026-123201Buku (bukuserver) through 5.1.1 contains an unauthenticated …5.3
- CVE-2026-123202libnxml before 0.18.6 contains a stack-based buffer overflow…7.5
- CVE-2026-123203NEURON (CoreNEURON) through 9.0.2 contains a stack buffer ov…6.1
- CVE-2026-123205accel-ppp before 1.15.0 contains a heap buffer overflow vuln…6.5
- CVE-2026-123206EdgeChat before 2.20.3 contains a missing authentication vul…3.7
- CVE-2026-123207LibreTV before v2.21.2 contains a server-side request forger…3.1
- CVE-2026-123208noname Electron desktop build v1.11.2 through v1.11.6.1 cont…8.8
- CVE-2026-12321JIT miscompilation in the JavaScript: WebAssembly component.…5.4
- CVE-2026-12322Clickjacking issue in the Widget: Gtk component. This vulner…5.4
Are you affected by CVE-2026-123204?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST