Executive brief
automatisch is an open-source workflow automation platform (a Zapier alternative) that allows users to build integrations and automation flows. A vulnerability in the HTTP Request app's Custom Request action allows authenticated users with 'manage Flow' permission to make the server fetch arbitrary URLs and retrieve sensitive response data, potentially exposing internal systems, APIs, and confidential information.
Technical details
A server-side request forgery (SSRF) vulnerability exists in the Custom Request action of the HTTP Request app in automatisch. The vulnerability allows low-privileged authenticated users with 'manage Flow' permission to craft requests that make the automatisch server fetch arbitrary URLs and return the full response body. The attack is network-accessible and requires authentication and the specific 'manage Flow' permission; no additional user interaction is required. An attacker can exploit this to access internal services, cloud metadata endpoints, private APIs, and confidential data not directly accessible to the attacker. The vulnerability was present through commit 41f3c56 and patches may be available in later versions.
Affected products
- automatisch automatisch through commit 41f3c56
Timeline
- 2026-08-10: disclosed