Postiz App CVE-2026-34577

Postiz versions prior to 2.21.3. The GET /public/stream endpoint is publicly accessible without authentication. Attacker appends .mp4 as query parameter to bypass validation: /public/stream?url=http://internal-service/.../metadata?x=.mp4. No victim interaction required.

Real-world risk is HIGH for cloud-hosted Postiz instances, despite no confirmed active exploitation (CISA KEV status negative). The CVSS 8.6 score accurately reflects severity: network-accessible (AV:N), trivially exploitable with low complexity (AC:L), requires no authentication (PR:N) or user interaction (UI:N), and achieves high confidentiality impact (C:H) with scope change (S:C) indicating access beyond the vulnerable component. The attack vector targeting cloud metadata endpoints is well-documented and frequently exploited in SSRF scenarios, making this vulnerability highly automatable once discovered. SSVC framework assessment: exploitation status is public (vulnerability disclosed with detailed advisory), automatable (yes - simple HTTP requests with crafted URLs), technical impact is partial (information disclosure of potentially sensitive credentials/configs). The lack of authentication requirement substantially increases risk as any network-reachable attacker can exploit this. Organizations should prioritize patching immediately, especially in AWS/GCP/Azure environments where metadata exposure can lead to full instance compromise through credential theft.

An unauthenticated attacker identifies a Postiz instance hosted on AWS EC2 and sends a GET request to https://target-postiz.com/public/stream?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/postiz-role?.mp4. The vulnerable endpoint bypasses validation (URL ends with .mp4 due to query parameter), proxies the request to the AWS metadata service, and returns IAM role credentials in the HTTP response. The attacker extracts temporary AWS access keys and uses them to access S3 buckets, RDS databases, or other AWS resources associated with the compromised role, potentially exfiltrating customer social media data, API tokens, or achieving broader cloud infrastructure compromise. The attack requires only basic HTTP knowledge and no authentication, making it accessible to low-skilled attackers.