The vulnerability is a server‑side request forgery that lets any signed‑in user, including those with a viewer role, specify arbitrary internal addresses in notification channels. By setting webhook or mail destinations to loopback, LAN, or link‑local addresses and invoking the test endpoint, an attacker can cause the server to issue HTTP requests to internal hosts, potentially exfiltrating data or probing the network. The weakness is captured as CWE‑918. While the flaw does not allow code execution or direct data disclosure, it provides a mechanism for internal network reconnaissance and could be combined with other vulnerabilities to reach deeper assets.

The affected product is MikroDash from SecOps‑7, version 0.8.78 and earlier. The official fix is released in version 0.8.79. No other vendors or product variants are listed.

The CVSS score of 5.3 indicates moderate impact, and the EPSS score is currently unavailable, implying no known exploitation trend. The vulnerability is not listed in the CISA KEV catalog. Based on the description, any authenticated user can trigger the request, so exploitation requires only user credentials, which may be easily obtained or shared. Attackers can therefore scan internal networks without needing privileged access, making the flaw a low‑threshold bridge to further attacks.