Strapi Open Source and Enterprise Headless CMS version 5.51.0 is vulnerable to a semi-blind Server-Side Request Forgery (SSRF) via webhook follow-redirect behavior. The webhook dispatcher follows HTTP redirects automatically without resolving the IP address after the redirect or checking if the redirected address is within private or link-local network ranges. This can lead to non-2xx HTTP responses from target endpoints being captured and reflected back to the caller.