Loading story…
Postiz, an AI social media scheduling tool, patched two server-side request forgery vulnerabilities affecting its public stream functionality. CVE-2026-34577 exposed an unauthenticated flaw in GET /public/stream, where a user-controlled url parameter could cause the server to fetch and return the full HTTP response to the requester. The endpoint relied on an extension check requiring the URL to end in mp4, but that validation could be trivially bypassed, enabling access to internal services, cloud metadata endpoints, and other internal network resources. The issue was fixed in version 2.21.3 and assigned CWE-918.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Postiz addressed CVE-2026-40168 in version 2.21.5, fixing an SSRF vulnerability present in versions prior to 2.21.5. References for the disclosure include a fixing commit, the v2.21.5 release, and a GitHub security advisory.
A second SSRF issue, CVE-2026-40168, was received by security-advisories@github.com on April 10, 2026. The flaw in /api/public/stream allowed attackers to supply a validated public HTTPS URL that redirected to an internal resource because the final destination was not re-validated after redirects.
Postiz fixed CVE-2026-34577, an unauthenticated SSRF flaw in the GET /public/stream endpoint that could proxy full HTTP responses from internal services and cloud metadata endpoints. The issue affected versions before 2.21.3 and relied on a trivially bypassable check that only verified whether the supplied URL ended with 'mp4'.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability in **Postiz** allows any authenticated user to escalate privileges to **SUPERADMIN** by forging JWTs through the application's **Skool integration callback**. Tracked as **`CVE-2026-48781`** and **`GHSA-j77w-h625-56q2`**, the flaw stems from attacker-controlled JSON being signed into a session-like token with the application's `JWT_SECRET`, while authentication logic trusted the token's claims without reloading the user record from the database. The bug affects Postiz versions prior to **`2.21.8`** and enables cross-tenant takeover, arbitrary organization impersonation, full access across the affected instance, exposure of all registered users, and the ability to post through victims' connected social media accounts. The issue is rated **CVSS 9.9 (Critical)**, was verified and patched by the vendor, and defenders are advised to upgrade to **`2.21.8`**, rotate JWT secrets if compromise is suspected, and review logs for impersonation or unauthorized access activity.
Jul 12, 2026
A high-severity **server-side request forgery** flaw tracked as `CVE-2026-63306` affects **stoatchat** versions before `0.13.5`, allowing unauthenticated attackers to abuse the `/proxy` and `/embed` endpoints with arbitrary URLs. The vulnerable endpoints reportedly lack DNS resolution filtering and private IP range validation, enabling requests to be routed toward internal network resources that should not be externally reachable. The issue can be used to enumerate internal services, fingerprint internal applications, and access cloud instance metadata endpoints, including by chaining redirects to reach otherwise restricted infrastructure. The vulnerability is classified as `CWE-918` and carries a CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N`; advisory data also indicates proof-of-concept exploitation and automatable attack potential. Version `0.13.5` is listed as unaffected.
Jul 17, 2026
gitroomhq released **Postiz App** `v2.21.8` with fixes for three security vulnerabilities tracked as `PSA-2026-2CAQ96`, `PSA-2026-WWFR8X`, and `PSA-2026-Q3TCPK`, and urged all users to upgrade immediately. The release was published by egelhaus and bundled the security patches with additional bug fixes, UI changes, and feature updates after 41 commits were merged into `main` since `v2.21.7`. One of the addressed issues, `PSA-2026-Q3TCPK`, was disclosed as an **unauthenticated arbitrary lifetime PRO grant via NowPayments webhook**, indicating that an attacker could abuse the payment webhook flow to assign PRO access without authentication. Alongside the security remediation, the release added contributor forms, media type detection helpers, notification list updates, and post creation method tracking, with bsantosh909 and egelhaus listed as contributors.
Jul 16, 2026