CVE-2026-40168

Postiz is an AI social media scheduling tool. Prior to 2.21.5, the /api/public/stream endpoint is vulnerable to SSRF. Although the application validates the initially supplied URL and blocks direct private/internal hosts, it does not re-validate the final destination after HTTP redirects. As a result, an attacker can supply a public HTTPS URL that passes validation and then redirects the server-side request to an internal resource.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/gitroomhq/postiz-app/commit/30e8b777098157362769226d1b46d83ad616cb06	Patch
https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.5	Product Release Notes
https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-34w8-5j2v-h6ww	Exploit Mitigation Vendor Advisory
https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-34w8-5j2v-h6ww	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gitroom:postiz:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Postiz es una herramienta de programación de redes sociales con IA. Antes de la versión 2.21.5, el endpoint /api/public/stream es vulnerable a SSRF. Aunque la aplicación valida la URL suministrada inicialmente y bloquea los hosts privados/internos directos, no vuelve a validar el destino final después de las redirecciones HTTP. Como resultado, un atacante puede suministrar una URL HTTPS pública que pasa la validación y luego redirige la solicitud del lado del servidor a un recurso interno.

Information

Published : 2026-04-10 20:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-40168

Mitre link : CVE-2026-40168

CVE.ORG link : CVE-2026-40168

JSON object : View

Products Affected

gitroom

postiz

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-40168", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40168", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T20:55:02.053732Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "gitroomhq", "product": "postiz-app", "versions": [{"status": "affected", "version": "< 2.21.5"}]}]}], "published": "2026-04-10T20:16:22.643", "references": [{"url": "https://github.com/gitroomhq/postiz-app/commit/30e8b777098157362769226d1b46d83ad616cb06", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.5", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-34w8-5j2v-h6ww", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-34w8-5j2v-h6ww", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Postiz is an AI social media scheduling tool. Prior to 2.21.5, the /api/public/stream endpoint is vulnerable to SSRF. Although the application validates the initially supplied URL and blocks direct private/internal hosts, it does not re-validate the final destination after HTTP redirects. As a result, an attacker can supply a public HTTPS URL that passes validation and then redirects the server-side request to an internal resource."}, {"lang": "es", "value": "Postiz es una herramienta de programaci\u00f3n de redes sociales con IA. Antes de la versi\u00f3n 2.21.5, el endpoint /api/public/stream es vulnerable a SSRF. Aunque la aplicaci\u00f3n valida la URL suministrada inicialmente y bloquea los hosts privados/internos directos, no vuelve a validar el destino final despu\u00e9s de las redirecciones HTTP. Como resultado, un atacante puede suministrar una URL HTTPS p\u00fablica que pasa la validaci\u00f3n y luego redirige la solicitud del lado del servidor a un recurso interno."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitroom:postiz:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8244F9F-08C4-4279-883D-470D3C7145F8", "versionEndExcluding": "2.21.5"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}