The vulnerability arises from the setWebhookResolver, which accepts a user‑supplied URL and stores it without any address validation. This type of vulnerability is classified as a Server‑Side Request Forgery, identified as CWE‑918. When a subscribed event fires, the server executes a blind outbound request to that stored URL, using the configured HTTP method and content type, and sends event data in a JSON body. This behavior allows an authenticated user to instruct the server to make arbitrary requests to internal or external endpoints. Based on the description, this could expose internal services or leak data. The lack of response handling means the caller cannot verify the outcome, mitigating detection but not preventing exploitation.

The impacted product is the Omnivore App API, specifically the code paths handling webhook configuration and event triggering within the Omnivore repository. Version information is not provided in the advisory, so all current deployments that have not applied a future fix remain susceptible.

The CVSS score of 5.3 places this in the medium severity range. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the attack requires an authenticated user to set a webhook, the threat is limited to users with legitimate access to the system; however, once set, the server can be coerced into accessing internal resources, which could expose internal services or leak data. Based on the description, it is inferred that the attacker might use this SSRF path to reach internal endpoints that could provide a conduit for lateral movement. No known exploits have been reported, but the blind nature of the request and lack of input validation make this a significant SSRF risk for environments with sensitive internal endpoints.