FKIE_CVE-2026-42346

Vulnerability from fkie_nvd - Published: 2026-05-08 23:16 - Updated: 2026-07-24 21:10
Severity
6.5 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Summary
Postiz is an AI social media scheduling tool. From version 2.16.6 to before version 2.21.7, all SSRF protections added in v2.21.4–v2.21.6 share a fundamental TOCTOU (Time-of-Check-Time-of-Use) vulnerability: isSafePublicHttpsUrl() resolves DNS to validate the target IP, but subsequent fetch() calls resolve DNS independently. An attacker controlling a DNS server can exploit this gap via DNS rebinding to redirect requests to internal network addresses. This issue has been patched in version 2.21.7.
References
security-advisories@github.comhttps://github.com/gitroomhq/postiz-app/commit/071143dcb01cdeb9d5d7019892f4c6ff7b19dbeb
security-advisories@github.comhttps://github.com/gitroomhq/postiz-app/releases/tag/v2.21.7
security-advisories@github.comhttps://github.com/gitroomhq/postiz-app/security/advisories/GHSA-f7jj-p389-4w45
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "postiz-app",
          "vendor": "gitroomhq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.16.6, \u003c 2.21.7"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Postiz is an AI social media scheduling tool. From version 2.16.6 to before version 2.21.7, all SSRF protections added in v2.21.4\u2013v2.21.6 share a fundamental TOCTOU (Time-of-Check-Time-of-Use) vulnerability: isSafePublicHttpsUrl() resolves DNS to validate the target IP, but subsequent fetch() calls resolve DNS independently. An attacker controlling a DNS server can exploit this gap via DNS rebinding to redirect requests to internal network addresses. This issue has been patched in version 2.21.7."
    },
    {
      "lang": "es",
      "value": "Postiz es una herramienta de programaci\u00f3n de redes sociales con IA. Desde la versi\u00f3n 2.16.6 hasta antes de la versi\u00f3n 2.21.7, todas las protecciones de SSRF a\u00f1adidas en las versiones 2.21.4-2.21.6 comparten una vulnerabilidad TOCTOU (Time-of-Check-Time-of-Use) fundamental: isSafePublicHttpsUrl() resuelve el DNS para validar la IP de destino, pero las llamadas subsiguientes a fetch() resuelven el DNS de forma independiente. Un atacante que controla un servidor DNS puede explotar esta brecha mediante el reencadenamiento de DNS para redirigir las solicitudes a direcciones de red internas. Este problema ha sido parcheado en la versi\u00f3n 2.21.7."
    }
  ],
  "id": "CVE-2026-42346",
  "lastModified": "2026-07-24T21:10:00.143",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-42346",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-11T14:35:45.263376Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-08T23:16:37.903",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/gitroomhq/postiz-app/commit/071143dcb01cdeb9d5d7019892f4c6ff7b19dbeb"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-f7jj-p389-4w45"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.