CVE-2026-40168

Postiz, an AI-powered social media scheduling platform, contains a Server-Side Request Forgery (SSRF) vulnerability in its /api/public/stream endpoint affecting versions prior to 2.21.5. The flaw exists because the application validates URLs at initial submission but fails to re-validate destinations after HTTP redirects, allowing attackers to bypass internal resource protections. An attacker can supply a legitimate public URL that passes validation checks and subsequently redirect the server-side request to private or internal resources. The vulnerability carries a CVSS score of 8.2 (HIGH) with a network-based attack vector requiring no authentication or user interaction, making it relatively easy to exploit. The attack has high confidentiality impact due to potential unauthorized access to internal systems, low integrity impact, and some availability implications. The associated EPSS score of 0.00056 indicates lower probability of real-world exploitation compared to other published CVEs. There is currently no evidence of active exploitation in the wild, as indicated by the vulnerability's absence from the Known Exploited Vulnerabilities (KEV) catalog and its inactive status on threat intelligence hot lists. No publicly available exploit code has been reported, and community attention remains minimal. Organizations using Postiz should prioritize upgrading to version 2.21.5 or later to remediate this SSRF vulnerability.