Stigmem versions prior to 0.9.0a11 allow an authenticated user to set an arbitrary delivery_address when creating a webhook. The application does not check whether the address resolves to an internal or external host. Because the server automatically posts fact‑change notifications to the specified URL, an attacker can cause the server to issue HTTP POST requests to private loopback or subnet addresses, giving them blind access to internal services not exposed externally. The weakness is a blind SSRF flaw (CWE‑918) that can potentially expose internal data or further compromise internal hosts.

The vulnerability affects the Stigmem web service from eidetic‑labs, specifically all releases before 0.9.0a11. Users of any earlier version who can authenticate to the service are able to create webhook subscriptions with malicious delivery addresses.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available, so the exact current exploitation probability is unknown, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attacker must first log in to the Stigmem instance and then create a webhook with a delivery_address pointing to a private or loopback IP; afterwards, generating a matching fact‑change event triggers the server‑side POST request. This constitutes the likely attack vector. The attack can result in blind SSRF against internal endpoints, potentially exposing internal information or enabling further internal exploitation.