An unauthenticated SSRF vulnerability in the Postiz AI social media scheduling tool, prior to version 2.21.5, poses a significant risk to internal network security.

The application fails to re-validate the destination URL after following HTTP redirects within the /api/public/stream endpoint. This flaw allows an unauthenticated attacker to bypass initial security checks and force the server to perform requests against internal, non-public resources.

Successful exploitation allows unauthorized attackers to probe internal services and network infrastructure that are otherwise hidden from the public internet. Given the CVSS score of 8.2, this vulnerability carries a high severity rating, as it can lead to unauthorized information disclosure or potential service disruption of internal business applications.

Immediate Action: Upgrade the Postiz application to version 2.21.5 or later, which includes the necessary logic to validate the final destination of redirected requests.

Proactive Monitoring: Monitor server access logs for anomalous requests directed at the /api/public/stream endpoint, specifically looking for repeated attempts involving redirect-based patterns.

Compensating Controls: Implement strict egress filtering at the network level to prevent the application server from initiating connections to sensitive internal subnets or unauthorized external endpoints.

Public Exploit Available: No (exploit_available: unknown)

The risk associated with this SSRF vulnerability is substantial due to its potential to expose internal network topology and services. Organizations currently running Postiz versions earlier than 2.21.5 must prioritize the upgrade process immediately to eliminate this attack vector and prevent potential unauthorized access to internal resources.