3 ms·

Does this require authenticated access to the posthog api to kick off? In that case I feel clickhouse and posthog both have their share of the blame here.

• nightpool 10mo ago
  It looks like the entire class of bugs here are "if you have access to Posthog's admin dashboard, you can configure webhook URLs that hit Posthog's internal services". That's not particularly surprising for a self-hosted system like the author's, but I expect it would pretty bad if you were using their cloud-hosted product.
  • anothercat 10mo ago
    Ah of couse! I forgot about the cloud hosted option.
    • nightpool 10mo ago
      In another comment, a Posthog security engineer mentions that this was resolved previously for their cloud-hosted product: https://news.ycombinator.com/item?id=46307696 https://news.ycombinator.com/item?id=46307696