The vulnerability is a blind Server‑Side Request Forgery in PinchTab’s optional scheduler. When a task is posted to /tasks with a user‑controlled callbackUrl, the v0.8.3 scheduler performs an outbound POST to that URL. The implementation validates only the URL scheme, accepting loopback, private, and link‑local addresses and following redirects, which permits the server to reach any HTTP(S) target reachable from the host. This flaw is limited to the webhook path and does not affect general request handling, but it allows an attacker to exfiltrate data or manipulate internal services via blind SSRF.

The affected product is PinchTab v0.8.3. The flaw appears only when the optional scheduler is enabled and reachable. Users running versions prior to v0.8.4 with the scheduler active are susceptible; the issue is mitigated by installing v0.8.4 or later, which validates callback URLs, rejects non‑public IP ranges, disables redirect following, and pins delivery to approved IPs.

The CVSS score is 4.1, indicating low to moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires ability to submit tasks via the master API token or a tokenless deployment, which typically requires administrative or unauthenticated access. If the scheduler is exposed to the internet, an attacker can target internal hosts; if it is only exposed locally, the risk is lower but still present. The likely attack vector is through an unauthenticated or privileged POST /tasks request, making the vulnerability practical in permissive configurations.