The vulnerability allows a low‑privileged authenticated user with "manage Flow" permission to instruct the automatically server to fetch any URL and return the response body through the Custom Request action. By directly passing user‑supplied URLs into the HTTP client without any SSRF safeguards, an attacker can access internal network services, metadata endpoints, and potentially exfiltrate sensitive data. This can compromise confidentiality, integrity, and availability of internal resources within the deployment environment.

The affected system is the automatically platform, specifically the backend module handling custom HTTP requests. The vulnerability resides in the file packages/backend/src/apps/http-request/actions/custom-request/index.js and applies to deployments that have not applied fixes provided in newer releases. No further vendor or product version details were supplied, so any release of automatically prior to the patch is potentially susceptible.

The CVSS score of 7.7 indicates a high severity with exploit potential. EPSS data is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting that it has not yet been widely exploited in the wild. However, because any authenticated user with the designated permission can trigger the SSRF, the potential impact on internal systems is considerable, especially in environments with exposed internal services or open metadata endpoints. The likely attack vector is an internal request originating from the server, making the vulnerability valuable for attackers seeking to bypass perimeter defenses.