The vulnerability in omnivore's setWebhookResolver allows an authenticated user to supply arbitrary URLs for webhook callbacks without address validation. When events fire, the callWebhook function issues HTTP requests to these URLs using axios, including attacker-controlled JSON payloads. Because the server blindly sends these requests and logs only success or error, an attacker can leverage this to perform SSRF attacks targeting internal network resources or metadata services. No official fix or patch is currently documented, and no known exploits are reported in the wild.

An authenticated user can exploit this vulnerability to cause the server to send arbitrary HTTP requests to internal or link-local network addresses. This can potentially expose internal services or metadata endpoints to attacker-controlled requests. The server does not expose the response to the attacker, limiting direct data exfiltration, but the SSRF can be used for reconnaissance or to trigger actions on internal systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict webhook URL inputs to trusted domains or implement network-level controls to prevent the server from making requests to sensitive internal addresses. Monitor server logs for unusual webhook request activity.