Dozzle allows unauthenticated clients to access POST /api/notifications/test-webhook, which forwards an attacker‑specified URL and optional headers to an external service. The response status and up to 1 MB of the response body are returned when the target replies with a non‑2xx status code. This enables an attacker to trigger outbound requests to arbitrary hosts and receive sensitive data from the response body, thereby exposing internal network services and leaking potentially confidential information.

The vulnerability affects Dozzle version 10.5.x and earlier when deployed with Docker’s default quickstart using no authentication (DOZZLE_AUTH_PROVIDER not set). Users running Dozzle 10.5.1 or earlier with unconstrained access to the /api/notifications/test-webhook endpoint are impacted.

With a CVSS score of 8.6, this SSRF is considered high severity. The EPSS score of 1% indicates a lower probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Because the endpoint is reachable without authentication in the default configuration, any host that can reach the Dozzle service can send a POST request to the test‑webhook URL, triggering a backend request to an attacker‑controlled host and exposing up to 1 MB of that response. If internal network hosts contain sensitive services, the attacker could discover them or exfiltrate data, making exploitation highly advantageous for a threat actor (inferred).