{"apiVersion":"1.0","identifier":"CVE-2026-76239","description":"Stigmem before 0.9.0a11 fails to validate the delivery_address parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback and private network destinations. Attackers can trigger matching fact-change events to cause the Stigmem server to issue server-side HTTP POST requests to internal services, enabling blind SSRF attacks against localhost and private network endpoints.","publishedAt":"2026-08-19T14:17:56","lastModifiedAt":"2026-08-21T12:16:33","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76239","cvssScore":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","epssProbability":0.00265,"riskScore":0.65,"affectedProduct":"Stigmem","affectedVersions":"<0.9.0a11","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-76239","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-76239","en":"https://www.redsauce.net/en/cves/CVE-2026-76239","fr":"https://www.redsauce.net/fr/cves/CVE-2026-76239","pt":"https://www.redsauce.net/pt/cves/CVE-2026-76239","de":"https://www.redsauce.net/de/cves/CVE-2026-76239","sk":"https://www.redsauce.net/sk/cves/CVE-2026-76239","el":"https://www.redsauce.net/el/cves/CVE-2026-76239"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-76239"}}