CVE-2023-46746

Name of the Vulnerable Software and Affected Versions PostHog versions prior to the version including commit 22bd5942

Description A server-side request forgery (SSRF) issue was found in PostHog, which can be exploited by authenticated users. The issue arises because PostHog did not verify whether a URL was local when enabling webhooks, allowing authenticated users to forge a POST request.

Recommendations For versions prior to the version including commit 22bd5942, update to a version that includes the fix commit 22bd5942 to resolve the issue. As a temporary workaround, consider disabling the webhooks feature until a patched version is available.