The vulnerability permits authenticated users with edit rights to create webhooks with arbitrary URLs, causing the Posta backend to send HTTP POST requests to any destination. Attackers can target loopback, private, or cloud‑metadata addresses, then observe delivery status codes and error messages to discover internal services, revealing hostnames, open ports and service availability. This allows internal network information disclosure and could be leveraged for further attacks.

The flaw is present in all releases of the goposta:posta application up to and including version 0.17.x. Versions 0.18.0 and later incorporate a fix that validates and restricts webhook URLs.

The CVSS score of 5.3 indicates a medium severity vulnerability. No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authentication with edit‑level permissions and depends on the ability to create a webhook. The attack vector is internal as the request originates from the Posta server. Once the webhook is created, the attacker can probe internal hosts and ports, potentially gathering reconnaissance or bypassing access controls.