CVE-2026-42346 Details
Description
Postiz is an AI social media scheduling tool. From version 2.16.6 to before version 2.21.7, all SSRF protections added in v2.21.4–v2.21.6 share a fundamental TOCTOU (Time-of-Check-Time-of-Use) vulnerability: isSafePublicHttpsUrl() resolves DNS to validate the target IP, but subsequent fetch() calls resolve DNS independently. An attacker controlling a DNS server can exploit this gap via DNS rebinding to redirect requests to internal network addresses. This issue has been patched in version 2.21.7.
A time-of-check-time-of-use (TOCTOU) vulnerability has been identified in the Postiz AI social media scheduling tool, specifically in versions 2.16.6 prior to 2.21.7. The issue arises from a flaw in the server-side request forgery (SSRF) protections implemented in versions 2.21.4 to 2.21.6. The function 'isSafePublicHttpsUrl()' correctly resolves DNS to validate target IPs, but the subsequent 'fetch()' calls resolve DNS independently. This creates a window of opportunity for an attacker controlling a DNS server to exploit DNS rebinding, redirecting requests to internal network addresses.
Users are advised to upgrade to Postiz version 2.21.7 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 8, 2026CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gitroomhq/postiz-app/commit/071143dcb01cdeb9d5d7019892f4c6ff7b19dbeb | [email protected] | Source CodeVendor |
| https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.7 | [email protected] | Release NotesVendor |
| https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-f7jj-p389-4w45 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Gitroomhq Postiz | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | New CVE Received | [email protected] |