An authenticated non‑admin user with SETTINGS permission can configure the WindowsPhoneNotify addon to send a blind HTTP POST from the pyLoad server to a user‑selected host, port, and path. Because the addon uses http.client without validating the destination, the request can probe internal services, reach cloud metadata endpoints, or trigger state‑changing internal HTTP endpoints. This behavior fulfills CWE‑918, allowing the attacker to learn information about the internal network or alter internal state via a blind request.

The vulnerability exists in all pyLoad installations prior to version 0.5.0b3.dev102. Affected users are those who have enabled the WindowsPhoneNotify addon and have the SETTINGS permission within pyLoad.

The CVSS score of 6.4 places the vulnerability in the medium severity range. EPSS is not available, and the issue is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user with SETTINGS rights, so the attack vector is user‑based configuration. Once an attacker has such a user account, they can initiate the blind POST to force the pyLoad server to contact arbitrary internal hosts.