« Volver al listado

CVE-2026-42346

Estado: AplazadaMedia (6.5)—

Postiz is an AI social media scheduling tool. From version 2.16.6 to before version 2.21.7, all SSRF protections added in v2.21.4–v2.21.6 share a fundamental TOCTOU (Time-of-Check-Time-of-Use) vulnerability: isSafePublicHttpsUrl() resolves DNS to validate the target IP, but subsequent fetch() calls resolve DNS independently. An attacker controlling a DNS server can exploit this gap via DNS rebinding to redirect requests to internal network addresses. This issue has been patched in version 2.21.7.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Gitroom — PostizAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-42346",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-42346",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-11T14:35:45.263376Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "gitroomhq",
          "product": "postiz-app",
          "versions": [
            {
              "status": "affected",
              "version": ">= 2.16.6, < 2.21.7"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-08T23:16:37.903",
  "references": [
    {
      "url": "https://github.com/gitroomhq/postiz-app/commit/071143dcb01cdeb9d5d7019892f4c6ff7b19dbeb",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.7",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-f7jj-p389-4w45",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Postiz is an AI social media scheduling tool. From version 2.16.6 to before version 2.21.7, all SSRF protections added in v2.21.4–v2.21.6 share a fundamental TOCTOU (Time-of-Check-Time-of-Use) vulnerability: isSafePublicHttpsUrl() resolves DNS to validate the target IP, but subsequent fetch() calls resolve DNS independently. An attacker controlling a DNS server can exploit this gap via DNS rebinding to redirect requests to internal network addresses. This issue has been patched in version 2.21.7."
    },
    {
      "lang": "es",
      "value": "Postiz es una herramienta de programación de redes sociales con IA. Desde la versión 2.16.6 hasta antes de la versión 2.21.7, todas las protecciones de SSRF añadidas en las versiones 2.21.4-2.21.6 comparten una vulnerabilidad TOCTOU (Time-of-Check-Time-of-Use) fundamental: isSafePublicHttpsUrl() resuelve el DNS para validar la IP de destino, pero las llamadas subsiguientes a fetch() resuelven el DNS de forma independiente. Un atacante que controla un servidor DNS puede explotar esta brecha mediante el reencadenamiento de DNS para redirigir las solicitudes a direcciones de red internas. Este problema ha sido parcheado en la versión 2.21.7."
    }
  ],
  "lastModified": "2026-07-24T21:10:00.143",
  "sourceIdentifier": "security-advisories@github.com"
}