4Qu4R1Um

**Name of the Vulnerable Software and Affected Versions** Tugtainer versions prior to 1.30.6 **Description** An authenticated user can trigger the backend server to send outbound HTTP requests to arbitrary user-supplied URLs. This occurs via the '/settings/test notification' endpoint, which accepts a `urls` field and passes it to Apprise without restricting protocols, hostnames, localhost addresses, private IP ranges, or cloud metadata addresses. This flaw enables an authenticated blind server-side request forgery (SSRF), a condition where an attacker induces the server to make requests to an unintended location. **Recommendations** Update to version 1.30.6.