An authenticated RoleMember user can call the POST /api/v1/notification endpoint and trigger the application to send a user‑supplied HTTP request synchronously. The application returns the entire response body for any non‑2xx status code with no size limit, effectively exposing internal or third‑party data to the attacker. This flaw is an SSRF that can be used to read arbitrary resources, potentially leaking sensitive information or causing denial‑of‑service by sending large payloads. Risk is mitigated only by controlling the destination URLs or removing the ability to expose response bodies.

nezhahq:nezha versions from 1.4.0 up to, but not including, 2.0.8 are affected; these versions expose the notification endpoints to RoleMember users.

The CVSS score of 7.7 indicates a high severity. EPSS is below 1%, suggesting low current exploitation probability. The vulnerability is not listed in CISA KEV. The attack vector is web‑based, requiring authentication as a RoleMember; no additional privileges are needed. An attacker who can gain a RoleMember account can target internal services or external systems, reflecting responses back to the user, which can be leveraged for information gathering or internal network probing.