{"affected":[{"defaultStatus":"unaffected","product":"MikroDash","source":"CNA: VulnCheck","vendor":"SecOps-7","versions":[{"lessThan":"0.8.79","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-125363","cwes":["CWE-918"],"description":"MikroDash before 0.8.79 contains a server-side request forgery vulnerability that allows any signed-in user, including the viewer role, to target internal addresses through notification channels. Attackers can set webhook or mail destinations to loopback, LAN or link-local addresses and call POST /api/notify-channels/{id}/test to probe the internal network.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":5.4,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1794266856416,"publishedAt":1794266856416,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/SecOps-7/MikroDash/security/advisories/GHSA-xf3p-2j7c-6hg4"},{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/SecOps-7/MikroDash/commit/4a40d104faa9f6d7b7539a3ce78fb91509d40cce"},{"source":"CNA: VulnCheck","tags":["release-notes"],"url":"https://github.com/SecOps-7/MikroDash/releases/tag/v0.8.79"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/SecOps-7/MikroDash/blob/v0.8.78/internal/server/notify_channels_api.go#L457"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/mikrodash-before-0.8.79-ssrf-via-personal-notification-channels"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/SecOps-7/MikroDash/commit/4a40d104faa9f6d7b7539a3ce78fb91509d40cce"}],"revision":"906a508f57735cdf45fa1a4ff23b704187d8b1a67eb8b067f356aefa277ca451","sources":[{"modifiedAt":1794266856416,"name":"CNA: VulnCheck","retrievedAt":1794269325407,"url":"https://www.cve.org/CVERecord?id=CVE-2026-125363"}],"ssvc":null,"status":"published","title":"MikroDash before 0.8.79 SSRF via Personal Notification Channels","updatedAt":1794269325407}