CVE-2026-72566

HIGH 7.7

automatisch - Server-Side Request Forgery via HTTP Request Custom Action

CVSS Score

7.7

EPSS Score

0.0%

EPSS Percentile

0th

A server-side request forgery (SSRF) vulnerability in automatisch through commit 41f3c56 allows a low-privileged authenticated user with 'manage Flow' permission to make the server fetch arbitrary URLs and retrieve the full response body via the HTTP Request app's Custom Request action.

CWE	CWE-918
Vendor	automatisch
Product	automatisch
Published	Aug 10, 2026
Last Updated	Aug 10, 2026

Stay Ahead of the Next One

Get instant alerts for automatisch automatisch

Be the first to know when new high vulnerabilities affecting automatisch automatisch are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

automatisch / automatisch

0 ≤ 41f3c56

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/automatisch/automatisch github.com: https://github.com/automatisch/automatisch/blob/main/packages/backend/src/apps/http-request/actions/custom-request/index.js

Credits

Bobur Abdugafforov