Dozzle allows unauthenticated clients to access POST /api/notifications/test-webhook, which forwards an attacker-specified URL and optional headers to an external service. The response status and up to 1 MB of the response body are returned when the target replies with a non‑2xx status code. This lets an attacker trigger outbound requests to arbitrary hosts, potentially exposing internal network services and leaking sensitive data contained in the response body (inferred).

The vulnerability affects Dozzle version 10.5.x and earlier when deployed with Docker’s default quickstart using no authentication (DOZZLE_AUTH_PROVIDER not set). Users running Dozzle 10.5.1 or earlier with unconstrained access to the /api/notifications/test-webhook endpoint are impacted.

With a CVSS score of 8.6, this SSRF is considered high severity. The EPSS score is 3%, indicating a moderate probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Because the endpoint is reachable without authentication in the default configuration, any host that can reach the Dozzle service can send a POST request to the test‑webhook URL, triggering a backend request to an attacker‑controlled host and exposing up to 1 MB of that response. If the internal network hosts sensitive services, the attacker could discover them or exfiltrate data, making exploitation highly advantageous for a threat actor (inferred).