EUVD-2026-63256
GHSA-w562-g8x6-3cj6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network GraphQL mutation requires low privileges (AV:N, PR:L); scope changes to internal systems reachable via SSRF (S:C); blind response constrains but does not eliminate confidentiality and integrity impact on subsequent systems.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation helper. When a subscribed event fires, callWebhook in packages/api/src/jobs/call_webhook.ts issues axios.request with that url, the method and Content-Type recorded on the webhook, and a JSON body carrying the event data, so an authenticated user can make the server send repeated attacker-shaped requests to internal endpoints, including link-local metadata addresses. The request is blind: callWebhook discards the result and writes only a success line or the axios error to the server log, so the response is not returned through the API.
AnalysisAI
Blind Server-Side Request Forgery in Omnivore's webhook registration flow allows any authenticated user to coerce the application server into issuing repeated HTTP requests to arbitrary internal endpoints, including cloud instance metadata services. The flaw affects all Omnivore API server deployments (CPE: cpe:2.3:a:omnivore-app:omnivore:*:*:*:*:*:*:*:*) and is rooted in setWebhookResolver accepting and persisting caller-supplied URLs with no address validation before callWebhook later executes them via axios. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | A valid authenticated session on the Omnivore instance is required (PR:L per CVSS 4.0 vector); no administrative role is needed-the setWebhook GraphQL mutation is available to all registered users. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (Medium) with PR:L correctly reflects the authentication prerequisite and the blind response behavior (VC:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Omnivore user registers a webhook URL of http://169.254.169.254/latest/meta-data/iam/security-credentials/ and subscribes it to a high-frequency event type such as article save. Each time the user or any automated import saves an article, callWebhook issues an axios POST to the AWS IMDSv1 metadata endpoint; in IMDSv1-enabled environments the response contains IAM role credentials in plaintext, which callWebhook writes to the server error log on non-2xx status. … |
| Remediation | The primary fix is upstream commit c4d7d8562e6b9aabb1d8e4dabca268e314baa43a (https://github.com/omnivore-app/omnivore/commit/c4d7d8562e6b9aabb1d8e4dabca268e314baa43a), which adds validateUrl() in setWebhookResolver to reject private and local IP targets at webhook registration time. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today