The vulnerability resides in the webhook creation endpoint of Postiz, where the supplied URL is only validated against a generic URL format. The missing safety check allows attackers to supply internal or private network addresses. When a post is published, the application retrieves this webhook URL without further validation and dereferences it, enabling a blind SSRF that can access services hidden behind the server’s network. Because the attacker has no feedback on the server’s response, the attack can be used to probe internal infrastructure or exfiltrate data from internal systems. The identified weakness corresponds to Category 918, Third‑Party Remote Address or URL Validation.

The affected product is the AI social media scheduler Postiz developed by GitRoom HQ. Versions earlier than 2.21.4 implement the insecure endpoint. Versions 2.21.4 and later have the proper @IsSafeWebhookUrl validator in place for all webhook‑related routes.

The CVSS base score of 5.4 indicates medium severity. No EPSS value is provided, and the vulnerability is not listed in the CISA KEV catalog, implying that while the flaw is straightforward to exploit, it may not be widely used in the wild. The attack vector is internal, requiring the victim to be running a compromised Postiz instance. Attackers can reach any internal network resource that the server can contact, which could include databases, internal APIs, or management consoles. In the absence of additional defenses, a successful exploit would compromise the confidentiality and integrity of those internal services.