Vulnerability · Published Apr 2, 2026 · Assigned by GitHub_M

CVE-2026-34590Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation

Medium 5.4

In plain English

A medium-severity server-side request forgery in postiz-app from gitroomhq. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 85.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Postiz is an AI social media scheduling tool. Prior to version 2.21.4, the POST /webhooks/ endpoint for creating webhooks uses WebhooksDto which validates the url field with only @IsUrl() (format check), missing the @IsSafeWebhookUrl validator that blocks internal/private network addresses. The update (PUT /webhooks/) and test (POST /webhooks/send) endpoints correctly apply @IsSafeWebhookUrl. When a post is published, the orchestrator fetches the stored webhook URL without runtime validation, enabling blind SSRF against internal services. This issue has been patched in version 2.21.4.

Affected products (as reported)

Vendor	Product	Versions
gitroomhq	postiz-app	< 2.21.4

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-wc9c-7cv8-m225 x_refsource_CONFIRM
https://github.com/gitroomhq/postiz-app/commit/5ae4c950db6aa516a31454b7a45b9480bca40a11 x_refsource_MISC
https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.4 x_refsource_MISC