Postiz versions before 2.21.5 contain an SSRF vulnerability in the /api/public/stream endpoint. The application performs validation on the initial URL to block private or internal hosts but does not validate the final URL after HTTP redirects. An attacker can exploit this by providing a public HTTPS URL that redirects to an internal resource, causing the server to make unintended requests to internal systems. This can lead to unauthorized access to internal network resources or information disclosure. The vulnerability is tracked as CVE-2026-40168 with a CVSS 3.1 score of 8.2 (high severity). No patch or vendor remediation level has been published yet.

Successful exploitation of this SSRF vulnerability could allow an attacker to cause the Postiz server to make HTTP requests to internal or private network resources that are otherwise inaccessible externally. This can lead to unauthorized information disclosure or interaction with internal services. The CVSS score indicates a high confidentiality impact with no integrity impact and low availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable endpoint or implementing network-level controls to prevent the server from making unauthorized internal requests. Monitor vendor communications for updates regarding an official patch or mitigation.