The vulnerability arises because the /webhooks/ creation endpoint relies on only format validation for the URL field, omitting the safety check that blocks internal or private network addresses. As a result, when a post is published the orchestrator retrieves the configured webhook URL without any runtime safety validation, enabling a blind SSRF attack that can target internal services. The flaw could allow an attacker to read or influence internal network resources by crafting a malicious webhook URL.

The affected product is Postiz, an AI‑powered social media scheduling platform from Gitroom HQ. Versions older than 2.21.4 contain the vulnerable endpoint; the update to v2.21.4 adds the necessary @IsSafeWebhookUrl validator to prevent this SSRF.

The CVSS score of 5.4 indicates medium severity, while the EPSS score below 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. A likely exploitation path involves creating a malicious webhook via the approved POST /webhooks/ endpoint, which the orchestrator later fetches blindly when a post is published, enabling internal network access.