CVE-2026-125363: MikroDash before 0.8.79 SSRF via Personal Notification Channels
MikroDash before 0.8.79 contains a server-side request forgery vulnerability that allows any signed-in user, including the viewer role, to target internal addresses through notification channels. Attackers can set webhook or mail destinations to loopback, LAN or link-local addresses and call POST /api/notify-channels/{id}/test to probe the internal network.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any signed-in user can exploit it, including users assigned the viewer role. No elevated administrative permissions are required.
What access does an attacker need?
The attacker needs valid credentials to sign in and the ability to configure a personal notification channel. They can then invoke the notification channel test endpoint to cause requests to attacker-selected internal addresses.
Are internal-only services in scope?
Yes. The vulnerable notification destinations can target loopback, LAN, and link-local addresses, allowing an authenticated user to probe services that may not be externally reachable.
How can defenders identify attempted exploitation?
Review requests to POST /api/notify-channels/{id}/test and inspect notification-channel webhook or mail destination settings for loopback, private LAN, or link-local addresses.