Skip to content
GAdvisory
PSA-2026-04-HVBMCVE-2026-34590GCVE-125-2026-04-HVBMApril 19, 2026Assigned March 30, 2026
5.4 Medium

SSRF via Webhook Creation Endpoint Missing URL Safety Validation

SSRF via Webhook Creation Endpoint Missing URL Safety Validation

Affected (1)

  • gitroomhqpostiz-app
    • ≥ 0Fixed in 2.21.4Affected

    All other versions: Unaffected

Mitigations

Solutions

  • Upgrade to v2.21.4 or later.

Exploits

  • Access to internal network / ressources.

Overview

The POST /webhooks/ endpoint for creating webhooks uses WebhooksDto which validates the url field with only @IsUrl() (format check), missing the @IsSafeWebhookUrl validator that blocks internal/private network addresses. The update (PUT /webhooks/) and test (POST /webhooks/send) endpoints correctly apply @IsSafeWebhookUrl. When a post is published, the orchestrator fetches the stored webhook URL without runtime validation, enabling blind SSRF against internal services.

Severity

CVSS v3
5.4 Medium
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Weaknesses (1)

References (2)

Credits (3)

  • offset
    Reporter · @offset
  • Enno Gelhaus
    Coordinator · @egelhaus
  • Enno Gelhaus
    Remediation developer · @egelhaus

Context

Impacts

  • Impacts could include: - Internal network scanning: An attacker can probe internal hosts and ports via timing differences in webhook delivery. Even though responses are not returned, reachability can be inferred. - Blind interaction with internal services: The SSRF sends POST requests with attacker-influenced body content (serialized post data) to internal services. Services without authentication (e.g., internal APIs, caches, message queues) could be manipulated. - Cloud metadata access: On cloud deployments (AWS, GCP, Azure), the instance metadata service at 169.254.169.254 may be reachable, potentially exposing IAM credentials or instance configuration. While the response is not reflected to the attacker, the POST request itself reaches the metadata service. - Persistence: The malicious webhook URL is stored in the database and triggered on every post publication until deleted, creating a persistent SSRF primitive.

Timeline

  1. 03/28/2026 13:05

    Postiz received the advisory.

  2. 03/29/2026 15:55

    Postiz acknowledged and verified the advisory.

  3. 03/29/2026 16:00

    Postiz developed the fix, verified it, created the release and published the advisory.

  4. 03/30/2026 18:44

    GitHub issued CVE-2026-34590 for this advisory.

© 2026 Gelhaus Solutions