CVE-2026-24736

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24736", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-26T19:06:16.058Z", "datePublished": "2026-01-27T20:54:51.489Z", "dateUpdated": "2026-01-28T15:17:12.814Z"}, "containers": {"cna": {"title": "Squidex has Server-Side Request Forgery (SSRF) Issue in Webhook Configuration", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/Squidex/squidex/security/advisories/GHSA-wxg2-953m-fg2w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Squidex/squidex/security/advisories/GHSA-wxg2-953m-fg2w"}], "affected": [{"vendor": "Squidex", "product": "squidex", "versions": [{"version": "<= 7.21.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-27T20:54:51.489Z"}, "descriptions": [{"lang": "en", "value": "Squidex is an open source headless content management system and content management hub. Versions of the application up to and including 7.21.0 allow users to define \"Webhooks\" as actions within the Rules engine. The url parameter in the webhook configuration does not appear to validate or restrict destination IP addresses. It accepts local addresses such as 127.0.0.1 or localhost. When a rule is triggered (Either manual trigger by manually calling the trigger endpoint or by a content update or any other triggers), the backend server executes an HTTP request to the user-supplied URL. Crucially, the server logs the full HTTP response in the rule execution log (lastDump field), which is accessible via the API. Which turns a \"Blind\" SSRF into a \"Full Read\" SSRF. As of time of publication, no patched versions are available."}], "source": {"advisory": "GHSA-wxg2-953m-fg2w", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-28T15:16:24.283859Z", "id": "CVE-2026-24736", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T15:17:12.814Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24736", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-28T15:16:24.283859Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T15:17:05.453Z"}}], "cna": {"title": "Squidex has Server-Side Request Forgery (SSRF) Issue in Webhook Configuration", "source": {"advisory": "GHSA-wxg2-953m-fg2w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Squidex", "product": "squidex", "versions": [{"status": "affected", "version": "<= 7.21.0"}]}], "references": [{"url": "https://github.com/Squidex/squidex/security/advisories/GHSA-wxg2-953m-fg2w", "name": "https://github.com/Squidex/squidex/security/advisories/GHSA-wxg2-953m-fg2w", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Squidex is an open source headless content management system and content management hub. Versions of the application up to and including 7.21.0 allow users to define \"Webhooks\" as actions within the Rules engine. The url parameter in the webhook configuration does not appear to validate or restrict destination IP addresses. It accepts local addresses such as 127.0.0.1 or localhost. When a rule is triggered (Either manual trigger by manually calling the trigger endpoint or by a content update or any other triggers), the backend server executes an HTTP request to the user-supplied URL. Crucially, the server logs the full HTTP response in the rule execution log (lastDump field), which is accessible via the API. Which turns a \"Blind\" SSRF into a \"Full Read\" SSRF. As of time of publication, no patched versions are available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-27T20:54:51.489Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24736", "state": "PUBLISHED", "dateUpdated": "2026-01-28T15:17:12.814Z", "dateReserved": "2026-01-26T19:06:16.058Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-27T20:54:51.489Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "squidex", "vendor": "Squidex", "versions": [{"status": "affected", "version": "<= 7.21.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:squidex.io:squidex:*:*:*:*:*:*:*:*", "matchCriteriaId": "AB9DAE12-3516-4E2E-8CFE-D464ACDD44C2", "versionEndIncluding": "7.21.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Squidex is an open source headless content management system and content management hub. Versions of the application up to and including 7.21.0 allow users to define \"Webhooks\" as actions within the Rules engine. The url parameter in the webhook configuration does not appear to validate or restrict destination IP addresses. It accepts local addresses such as 127.0.0.1 or localhost. When a rule is triggered (Either manual trigger by manually calling the trigger endpoint or by a content update or any other triggers), the backend server executes an HTTP request to the user-supplied URL. Crucially, the server logs the full HTTP response in the rule execution log (lastDump field), which is accessible via the API. Which turns a \"Blind\" SSRF into a \"Full Read\" SSRF. As of time of publication, no patched versions are available."}, {"lang": "es", "value": "Squidex es un sistema de gesti\u00f3n de contenido sin cabeza de c\u00f3digo abierto y un centro de gesti\u00f3n de contenido. Las versiones de la aplicaci\u00f3n hasta la 7.21.0 inclusive permiten a los usuarios definir 'Webhooks' como acciones dentro del motor de Reglas. El par\u00e1metro url en la configuraci\u00f3n del webhook no parece validar ni restringir las direcciones IP de destino. Acepta direcciones locales como 127.0.0.1 o localhost. Cuando se activa una regla (Ya sea por activaci\u00f3n manual llamando manualmente al endpoint de activaci\u00f3n o por una actualizaci\u00f3n de contenido o cualquier otra activaci\u00f3n), el servidor backend ejecuta una solicitud HTTP a la URL proporcionada por el usuario. Fundamentalmente, el servidor registra la respuesta HTTP completa en el registro de ejecuci\u00f3n de la regla (campo lastDump), que es accesible a trav\u00e9s de la API. Lo que convierte un SSRF 'Ciego' en un SSRF de 'Lectura Completa'. Al momento de la publicaci\u00f3n, no hay versiones parcheadas disponibles."}], "id": "CVE-2026-24736", "lastModified": "2026-06-17T10:23:30.480", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24736", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-28T15:16:24.283859Z", "version": "2.0.3"}}]}, "published": "2026-01-27T21:16:02.967", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/Squidex/squidex/security/advisories/GHSA-wxg2-953m-fg2w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T01:56:26.064603+00:00", "value": {"mitigation_remediation": ["Restrict webhook URLs to a predefined whitelist of approved domains or IP ranges; reject any URLs that are local or private network addresses.", "Disable or tightly control the use of custom webhook actions within the Rules engine; consider removing the feature if not needed.", "Implement network\u2011level outbound request filtering to block the application from reaching internal IP ranges or non\u2011public endpoints; configure firewall rules around the Squidex service.", "Monitor the rule execution logs for unusual or unauthorized entries and set up alerting for frequent response dumps."], "summary": {"action": "Immediate Patch", "impact": "Full Read Server\u2011Side Request Forgery (SSRF) with remote data exfiltration"}, "threat_synthesis": {"affected_systems": "Squidex open\u2011source headless content management system, specifically versions up to and including 7.21.0 of the Squidex application. The issue is present in the Rules engine\u2019s webhook configuration feature.", "description_and_impact": "The vulnerability allows an attacker to define a webhook URL that bypasses destination validation and is invoked when a rule is triggered. The backend server then performs an HTTP request to the attacker\u2011supplied URL and logs the entire response in the rule execution log. This turns a typical blind SSRF into a full read SSRF, enabling the attacker to read arbitrary internal or external HTTP responses via the public API, facilitating network reconnaissance, data exfiltration, or further pivoting.", "risk_and_exploitability": "With a CVSS score of 9.1, the flaw is considered critical in terms of impact. The EPSS score is below 1\u202f%, indicating a low current exploit probability, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers that can trigger rules or provoke webhook execution could exploit this weakness remotely, gaining visibility into internal network services and potentially read sensitive data returned by those services. The lack of a patched version and the ability to log unfiltered responses amplify the risk for exposed deployments."}}}}, "created": "2026-01-28T12:22:09.083398+00:00", "updated": "2026-04-18T02:00:10.471290+00:00", "vendors": ["squidex.io", "squidex.io$PRODUCT$squidex"]}