What is GHSA-8vfr-hg2j-ch26?

GHSA-8vfr-hg2j-ch26 is a security advisory published by GitHub Security Advisories with High severity. A server-side request forgery (SSRF) vulnerability in automatisch through commit 41f3c56 allows a...

Which CVE IDs does GHSA-8vfr-hg2j-ch26 cover?

GHSA-8vfr-hg2j-ch26 covers the following CVE IDs: CVE-2026-72566. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8vfr-hg2j-ch26?

GHSA-8vfr-hg2j-ch26 has a CVSS v3 base score of 7.7, published by GitHub Security Advisories.

GHSA-8vfr-hg2j-ch26HighCVSS 7.7

A server-side request forgery (SSRF) vulnerability in automatisch through commit 41f3c56 allows a...

Vendor

GitHub Security Advisories

Published

August 10, 2026

Last Modified

August 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-72566 →

📋 Description

A server-side request forgery (SSRF) vulnerability in automatisch through commit 41f3c56 allows a low-privileged authenticated user with 'manage Flow' permission to make the server fetch arbitrary URLs and retrieve the full response body via the HTTP Request app's Custom Request action.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-72566
https://github.com/automatisch/automatisch
https://github.com/automatisch/automatisch/blob/main/packages/backend/src/apps/http-request/actions/custom-request/index.js
https://github.com/advisories/GHSA-8vfr-hg2j-ch26