Read the docs
TI-2023-25229 Aliases CVE-2023-46746

Authenticated PostHog users vulnerable to SSRF

Priority LOW 22CWE-918Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

PostHog provides open-source product analytics, session recording, feature flagging and A/B testing that you can self-host. A server-side request forgery (SSRF), which can only be exploited by authenticated users, was found in Posthog. Posthog did not verify whether a URL was local when enabling webhooks, allowing authenticated users to forge a POST request. This vulnerability has been addressed in `22bd5942` and will be included in subsequent releases. There are no known workarounds for this vulnerability.

Why it matters now

EPSS 0.00381 32nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PostHogposthogup to 1.43.1—No fix listedCNA
  • posthog VendorPostHog Affected up to 1.43.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:posthog:posthog:*:*:*:*:*:*:*:*up to 1.43.1VulnerablePostHog
  • cpe:2.3:a:posthog:posthog:*:*:*:*:*:*:*:* Versions up to 1.43.1 Vulnerable ·PostHog

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-46746

References

Patch 1

Advisory 1

Other 1

  • TI-2025-01307 SQL injection in PostHog CVSS 3.1HIGH 8.0
  • TI-2024-09007 Server-side request forgery in PostHog CVSS 3.1HIGH 8.3
  • TI-2025-01309 Server-side request forgery in PostHog CVSS 3.1MEDIUM 6.5
  • TI-2025-01308 Server-side request forgery in PostHog CVSS 3.1MEDIUM 6.5
  • TI-2022-00561 Open redirect vulnerability via endpoint authorize_and_redirect/?redirect= in posthog/posthog CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences