Executive brief
Postiz is an AI-powered tool used for scheduling and managing social media posts. A security flaw in its webhook system allows an attacker to force the application to send requests to internal network services that are not intended to be public. This could lead to the exposure of sensitive internal data, unauthorized interaction with private infrastructure, or the theft of cloud environment credentials.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Postiz due to insufficient validation of webhook URLs during the creation process. While the update and test endpoints utilize the '@IsSafeWebhookUrl' validator, the initial creation endpoint (POST /webhooks/) only performs a basic format check using '@IsUrl()'. This allows an authenticated attacker to register webhooks pointing to internal or private IP addresses, such as 127.0.0.1 or cloud metadata services (169.254.169.254). When a social media post is subsequently published, the backend orchestrator triggers the stored URL without further validation. This results in a persistent, blind SSRF that can be used for internal port scanning or interacting with unauthenticated internal APIs. The vulnerability is resolved in version 2.21.4 by applying the safety validator to the creation DTO.
Affected products
- gitroomhq Postiz < 2.21.4
Timeline
- 2026-03-28: disclosed: Postiz received the advisory from a researcher.
- 2026-03-29: patched: Fix developed and version 2.21.4 released.
- 2026-04-02: advisory: CVE-2026-34590 published.