🎯 New Report #3623149: SSRF via User-Controlled Push proxyServer in Notifications Push Registration
🔺Severity: Medium
👽 Reporter: yoyomiski
⭐️ Reputation: 1101
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-03-23
⏰ Disclosed: 2026-09-30 15:43:58
📝 Summary: A server-side request forgery vulnerability was discovered in the notifications application version 5.0.0. An authenticated user with low privileges could register a push device with an attacker-controlled proxy server address through the push registration endpoint. When a notification was triggered for that user, the backend performed an outbound POST request to the attacker-specified proxy server address, allowing the backend to make HTTP requests to arbitrary destinations including internal services.
📂 Report JSON File: 3623149
@hackeronereports