Skip to content
GAdvisory
PSA-2026-04-6EZ5CVE-2026-40168GCVE-125-2026-04-6EZ5April 22, 2026Assigned April 10, 2026
8.2 High

Server-Side Request Forgery via Redirect Bypass in /api/public/stream

Server-Side Request Forgery via Redirect Bypass in /api/public/stream

Affected (1)

  • gitroomhqpostiz-app
    • ≥ 0Fixed in 2.21.5Affected

    All other versions: Unaffected

Mitigations

Solutions

  • Upgrade to v2.21.5 or later.

Exploits

  • Full-read access to the internal network.

Overview

The /api/public/stream endpoint is vulnerable to SSRF. Although the application validates the initially supplied URL and blocks direct private/internal hosts, it does not re-validate the final destination after HTTP redirects. As a result, an attacker can supply a public HTTPS URL that passes validation and then redirects the server-side request to an internal resource.

Severity

CVSS v3
8.2 High
8.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
Low

Weaknesses (1)

References (2)

Credits (3)

  • S4nso
    Reporter · https://github.com/S4nso
  • egelhaus
    Coordinator · https://github.com/egelhaus
  • nevo-david
    Remediation developer · https://github.com/nevo-david

Context

Impacts

  • Internal network scanning: An attacker can probe internal hosts and ports via timing differences in webhook delivery. Even though responses are not returned, reachability can be inferred.

  • Blind interaction with internal services: The SSRF sends POST requests with attacker-influenced body content (serialized post data) to internal services. Services without authentication (e.g., internal APIs, caches, message queues) could be manipulated.

  • Cloud metadata access: On cloud deployments (AWS, GCP, Azure), the instance metadata service at 169.254.169.254 may be reachable, potentially exposing IAM credentials or instance configuration. While the response is not reflected to the attacker, the POST request itself reaches the metadata service.

  • Persistence: The malicious webhook URL is stored in the database and triggered on every post publication until deleted, creating a persistent SSRF primitive.

Timeline

  1. 04/03/2026 08:39

    Postiz has received the advisory.

  2. 04/03/2026 15:17

    Postiz has acknowledged and tested the advisory.

  3. 04/09/2026 12:20

    Postiz has developed the fix, tested it, created the release and published the advisory.

  4. 04/10/2026 17:10

    GitHub has issued CVE-2026-40168 for this advisory.

© 2026 Gelhaus Solutions