CVE-2025-9821 — SSRF via webhook function

Description (CNA)

SummaryUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed DetailsWhen sending webhooks, the destination is not validated, causing SSRF. ImpactBypass of firewalls to interact with internal services. See https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/ for more potential impact. Resources https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html for more information on SSRF and its fix.

Affected (CNA)

Vendor / product	Versions
Mautic / Mautic	affected >= 4.4.0 through < 4.4.17; affected >= 5.0.0-alpha through < 5.2.8; affected >= 6.0.0-alpha through < 6.0.5

CWE

CWE-918

References

https://github.com/mautic/mautic/security/advisories/GHSA-hj6f-7hp7-xg69

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.