CVE-2026-8725 | CoreWorxLab CAAL up to 1.6.0 test-hass Endpoint src/caal/webhooks.py server-side request forgery

A vulnerability was found in CoreWorxLab CAAL up to 1.6.0. It has been rated as critical. The affected element is an unknown function of the file src/caal/webhooks.py of the component test-hass Endpoint. This manipulation causes server-side request forgery.

This vulnerability is registered as CVE-2026-8725. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.