{"items":[{"id":"NVI-00018412","kind":"vulnerability","title":"Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-3v9w-6365-9w54","CVE-2026-45298"],"plain_summary":"GitHub lists this reviewed advisory for github.com/amir20/dozzle. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1f72b93b53b44837c9b48ff3447525e8"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-08T23:35:23.000Z","value":"8.6 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-1f72b93b53b44837c9b48ff3447525e8"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1f72b93b53b44837c9b48ff3447525e8","url":"https://github.com/advisories/GHSA-3v9w-6365-9w54","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-3v9w-6365-9w54","publisher":"GitHub Advisory Database","observed_at":"2026-11-07T00:50:36.189Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1f72b93b53b44837c9b48ff3447525e8"],"technology":"github.com/amir20/dozzle","known_exclusions":[],"conditions_summary":"## Summary\n\nIn a default dozzle deploy (the documented quickstart, no `DOZZLE_AUTH_PROVIDER` set), `POST /api/notifications/test-webhook` is reachable without authentication and forwards an attacker-controlled URL into a `WebhookDispatcher` that:\n\n- Sends an HTTP POST to the supplied URL with attacker-controlled request headers, and\n- Returns the response status code AND up to 1MB of the response body to the caller, when the target replies non-2xx.\n\nThis is a classic full-reflection SSRF, pre-auth, against any IP/port that dozzle's host can route to — including private subnets, link-local cloud metadata, and loopback services.\n\n## Affected versions\n\n`internal/notification/dispatcher/webhook.go` and `internal/web/notifications.go` at commit `581bab3a43ead84ea4d009a469a17af98fb3377f` and earlier (the test-webhook handler has been in place since the notifications subsystem was added).\n\n## Default-deploy reachability chain\n\n```\nmain.go:58-59           → enforces AuthProvider in {none, forward-proxy, simple}\nsupport/cli/args.go:18  → AuthProvider default is \"none\"\nmain.go:231-243         → when AuthProvider == \"none\", web.AuthProvider stays at NONE\ninternal/web/routes.go:130-132, 137-13","public_affected_ranges":["<= 8.14.12"]}],"null_published_at":"2026-11-07T07:07:39.833Z","source_updated_at":"2026-06-08T23:35:23.000Z","source_disclosed_at":"2026-05-18T16:41:39.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-07T00:50:36.189Z"}],"next_cursor":null,"snapshot_revision":"42594"}