CVE-2026-40168 — Postiz is an AI social media scheduling tool. Prior to 2.21.5, the…

/HIGH
CVE Notify vulnerabilitycvetools
CVE-2026-40168 — Postiz is an AI social media scheduling tool. Prior to 2.21.5, the…

🚨 CVE-2026-40168 Postiz is an AI social media scheduling tool. Prior to 2.21.5, the /api/public/stream endpoint is vulnerable to SSRF. Although the application validates the initially supplied URL and blocks direct private/internal hosts, it does not re-validate the final destination after HTTP red

feat: security fixes · gitroomhq/postiz-app@30e8b77
github.com

What This Means For You

  • New vulnerability disclosed — verify if your stack is exposed.
  • New tool or resource available — evaluate for your security workflow.

Related ATT&CK Techniques

T1595.002 Scanning IP Blocks Reconnaissance T1071.001 Web Protocols Command and Control T1190 Exploit Public-Facing Application Initial Access

Indicators of Compromise

IDTypeIndicator
CVE-2026-40168 Vulnerability CVE-2026-40168
🔎
Get the full picture on this threat Use /org to search affected organizations, generate IOC briefs with /brief, and set watchlist alerts — inside Telegram.
Try Intel Bot →
Source & Attribution
Source PlatformTelegram
ChannelCVE Notify
Channel ID1129491012
Message ID158854
PublishedApril 10, 2026 at 23:27 UTC
Original Linkhttps://github.com/gitroomhq/postiz-app/commit/30e8b77709...

This content was curated and summarized by Shimi's Cyber World for informational purposes. It is not copied or republished in full. All intellectual property rights remain with the original author and source.

Believe this infringes your rights? Submit a takedown request.