Threats affecting pkg:golang/posta

CVE-2026-123204 is a server-side request forgery (SSRF) vulnerability in goposta posta versions before 0.18.0. Authenticated users with edit rights can exploit this flaw by creating webhooks with arbitrary URLs, causing the backend to send POST requests to internal network destinations. This allows attackers to probe internal hosts and ports, including loopback, private network, or cloud metadata addresses, by reading delivery status codes and error messages. The vulnerability has a medium severity with a CVSS score of 5.3. It was fixed in version 0.18.0.