Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Postiz is an AI social media scheduling tool. Prior to 2.21.5, the /api/public/stream endpoint is vulnerable to SSRF. Although the application validates the initially supplied URL and blocks direct private/internal hosts, it does not re-validate the final destination after HTTP redirects. As a result, an attacker can supply a public HTTPS URL that passes validation and then redirects the server-side request to an internal resource.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-40168 Postiz is an AI social media scheduling tool. Prior to 2.21.5, the /api/public/stream endpoint is vulnerable to SSRF. Although the application validates the initially… https://www.cve.org/CVERecord?id=CVE-2026-40168
Post summary
CVE-2026-40168 targets Postiz’s /api/public/stream endpoint, causing an SSRF flaw that is remedied in version 2.21.5; no PoC or exploit details are disclosed.
CVE-2026-40168 Server-Side Request Forgery in Postiz Prior to 2.21.5 via HTTP Redirect https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40168
Post summary
The entry announces the discovery of CVE‑2026‑40168, a server‑side request forgery vulnerability in Postiz before v2.21.5 that occurs via HTTP redirects, but provides no PoC, exploitation code, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | gitroom | postiz | - | - | - |