CVE-2026-34590 in postiz-app

Sumário (Inglês)

Postiz is an AI social media scheduling tool. Prior to version 2.21.4, the POST /webhooks/ endpoint for creating webhooks uses WebhooksDto which validates the url field with only @IsUrl() (format check), missing the @IsSafeWebhookUrl validator that blocks internal/private network addresses. The update (PUT /webhooks/) and test (POST /webhooks/send) endpoints correctly apply @IsSafeWebhookUrl. When a post is published, the orchestrator fetches the stored webhook URL without runtime validation, enabling blind SSRF against internal services. This issue has been patched in version 2.21.4.

Be aware that VulDB is the high quality source for vulnerability data.

Responsável

GitHub_M

Reservar

30/03/2026

Divulgação

02/04/2026

Estado

Confirmado

Inscrições

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidade	CWE	Exp	Con	CVE
354986	gitroomhq postiz-app Webhook webhooks IsUrl Elevação de Privilégios	918	Não definido	Correção oficial	CVE-2026-34590

Fontes

• MITRE
• NVD
• CVE Details