Uncontrolled URL Access in AI Social Media Scheduling Tool by Gitroom
CVE-2026-34577

8.6HIGH

Key Information:

Vendor

Gitroomhq

Status
Postiz-app
Vendor
CVE Published:
2 April 2026

What is CVE-2026-34577?

The Postiz AI social media scheduling tool has a significant vulnerability in its PublicController's GET /public/stream endpoint. Earlier than version 2.21.3, this endpoint accepts a user-supplied URL query parameter without adequate validation, allowing attackers to leverage URL manipulation. The limited validation, which only checks for the '.mp4' suffix, can easily be bypassed. This oversight permits unauthenticated users to spoof requests and access sensitive responses from internal services and cloud metadata endpoints, potentially compromising network security. This issue has been addressed in the latest release, version 2.21.3.

Affected Version(s)

postiz-app < 2.21.3

References

https://github.com/gitroomhq/postiz-app/security/advisori...
x_refsource_CONFIRM
https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.3
x_refsource_MISC

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.