The vulnerability allows an attacker to define a webhook URL that bypasses destination validation and is invoked when a rule is triggered. The backend server then performs an HTTP request to the attacker‑supplied URL and logs the entire response in the rule execution log. This turns a typical blind SSRF into a full read SSRF, enabling the attacker to read arbitrary internal or external HTTP responses via the public API, facilitating network reconnaissance, data exfiltration, or further pivoting.

Squidex open‑source headless content management system, specifically versions up to and including 7.21.0 of the Squidex application. The issue is present in the Rules engine’s webhook configuration feature.

With a CVSS score of 9.1, the flaw is considered critical in terms of impact. The EPSS score is below 1 %, indicating a low current exploit probability, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers that can trigger rules or provoke webhook execution could exploit this weakness remotely, gaining visibility into internal network services and potentially read sensitive data returned by those services. The lack of a patched version and the ability to log unfiltered responses amplify the risk for exposed deployments.