The postiz-app (versions before 2.21.5) contains an SSRF vulnerability in the /api/public/stream endpoint. The application attempts to block SSRF by validating the initial URL to prevent access to private/internal hosts. However, it does not validate the final URL after following HTTP redirects. An attacker can exploit this by providing a public HTTPS URL that redirects to an internal resource, causing the server to make unauthorized requests to internal systems. This flaw is classified under CWE-918 (Server-Side Request Forgery). The vulnerability is publicly known as CVE-2026-40168 with a CVSS 3.1 score of 8.2, indicating high severity. No patch or vendor remediation level is currently documented, and no known exploits are reported in the wild.

Successful exploitation allows an attacker to make the server perform HTTP requests to internal network resources that are otherwise inaccessible externally. This can lead to unauthorized information disclosure from internal systems. The CVSS score reflects high confidentiality impact with no integrity impact and low availability impact. There is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the vulnerable endpoint or implementing network-level controls to prevent the server from making unauthorized internal requests. Avoid exposing the /api/public/stream endpoint to untrusted users if possible.