CVE-2026-77067: Server-Side Request Forgery (SSRF) in omnivore-app omnivore
Description
The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation helper. When a subscribed event fires, callWebhook in packages/api/src/jobs/call_webhook.ts issues axios.request with that url, the method and Content-Type recorded on the webhook, and a JSON body carrying the event data, so an authenticated user can make the server send repeated attacker-shaped requests to internal endpoints, including link-local metadata addresses. The request is blind: callWebhook discards the result and writes only a success line or the axios error to the server log, so the response is not returned through the API.
CVSS v4.0
Score 5.3medium
Affected software
omnivore-app
omnivore
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The setWebhookResolver in omnivore-app omnivore accepts a URL from an authenticated user without validating the address. When an event fires, the server uses axios to send a request to this URL with the specified method, content-type, and event data in JSON format. Because there is no address validation, an attacker can cause the server to send requests to internal or link-local addresses, potentially accessing internal resources. The server logs success or error but does not expose the response to the API caller, making it a blind SSRF. This vulnerability affects version 0 of the product.
Potential Impact
An authenticated user can exploit this vulnerability to cause the server to send arbitrary HTTP requests to internal or link-local network addresses. This can lead to unauthorized access to internal services or metadata endpoints that are not normally accessible externally. The blind nature of the request means the attacker does not receive direct response data, but repeated requests could be used to infer information or trigger actions on internal systems.
Mitigation Recommendations
No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict webhook URL inputs to trusted domains or implement network-level controls to prevent server-side requests to internal or sensitive addresses.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-20T10:50:24.777Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a86e394acd9273b498799cc
Added to database: 08/20/2026, 11:23:00 UTC
Last enriched: 09/25/2026, 02:42:06 UTC
Last updated: 10/04/2026, 18:53:18 UTC
Views: 74
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.