This vulnerability (CVE-2026-72566) in automatisch through commit 41f3c56 enables a low-privileged authenticated user who has the 'manage Flow' permission to exploit an SSRF flaw. The attacker can cause the server to send requests to arbitrary URLs and obtain the full response body using the HTTP Request app's Custom Request action. The CVSS 3.1 score is 7.7, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and a confidentiality impact classified as high. There is no indication of integrity or availability impact. No patch or remediation information is provided in the available data.

The vulnerability allows an attacker with limited privileges to make the server perform arbitrary HTTP requests and retrieve sensitive data from internal or external resources. This can lead to unauthorized disclosure of confidential information accessible to the server. There is no evidence of impact on data integrity or system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict 'manage Flow' permissions to trusted users only to reduce risk.