The vulnerability allows a user who is logged in as an authenticated Application Admin to specify arbitrary webhook destination URLs that are not validated by the server. By triggering the webhook mechanism, the application will make HTTP or HTTPS requests to the provided URL, effectively turning the server into a client capable of reaching any internal or external endpoint reachable from the server's network. This can lead to exposure of sensitive internal services, data exfiltration, or the ability to orchestrate further attacks against the infrastructure where Libredesk is hosted.

Libredesk, a self‑hosted customer support desk application, is affected in all releases prior to version 1.0.2-0.20260215211005-727213631ce6. The fix was applied in the referenced commit and released in that specific version.

The CVSS score of 6.9 indicates medium severity, and the EPSS score of less than 1% suggests that the likelihood of exploitation in the wild is low. The vulnerability is not listed in the CISA KEV catalog, further indicating its current standing as an unexploited or low‑profile flaw. Attackers would need the credentials of an Application Admin to activate the webhook, after which the server could be coerced to reach protected internal resources or other services, potentially compromising the underlying cloud or corporate network.