CVE-2026-125363

Name of the Vulnerable Software and Affected Versions MikroDash versions prior to 0.8.79

Description Any signed-in user, including those with the viewer role, can perform a server-side request forgery (SSRF) through notification channels. This occurs when attackers configure webhook or mail destinations to target loopback, LAN, or link-local addresses. By calling the 'POST /api/notify-channels/{id}/test' endpoint, an attacker can probe the internal network.

Recommendations Update MikroDash to version 0.8.79 or later. Restrict access to the 'POST /api/notify-channels/{id}/test' endpoint to minimize the risk of internal network probing.