CVE-2026-40168
High
Description
Postiz is an AI social media scheduling tool. Prior to 2.21.5, the /api/public/stream endpoint is vulnerable to SSRF. Although the application validates the initially supplied URL and blocks direct private/internal hosts, it does not re-validate the final destination after HTTP redirects. As a result, an attacker can supply a public HTTPS URL that passes validation and then redirects the server-side request to an internal resource.
SeverityHigh
CVSS8.2
Exploit probability—
ProductGitroom Postiz
PublishedApr 10, 2026
First seenApr 10, 2026
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- gitroom postiz2.21.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gitroom postiz | v < 2.21.5 | 2.21.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.