2023 PostHog — CVE-2023-46746 SSRF in webhooks

2023 Unknown records affected

Data compromised

Potential: internal resource access

Technical writeup

Critical vulnerability in open-source platform: CVE-2023-46746 SSRF via improper URL validation in webhooks. Authenticated users could forge POST requests. No confirmed user data theft on PostHog Cloud.

Root cause

Improper URL validation; SSRF

References

https://nvd.nist.gov/vuln/detail/CVE-2023-46746