CVE-2026-115931: CWE-470 in GitroomHQ postiz-app

The postiz-app backend does not restrict which internal helper functions a signed-in user can request to run on their connected channels. One such helper reads files from the server disk, and if a user connects a channel with a stored token representing a file path, the backend will return the contents of that file. This can expose sensitive data including secrets used for session signing and database credentials. Another helper function allows the backend process to be terminated with a single request. Since self-registration is open by default, an attacker can exploit these flaws without existing credentials or assistance.

An attacker with a valid account can read arbitrary files on the server, exposing highly sensitive information such as environment variables containing secrets and credentials. They can also cause a denial of service by terminating the backend process. Because self-registration is enabled by default, no prior access or user interaction is required to exploit these vulnerabilities. The CVSS 3.1 score of 9.9 reflects critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or disable self-registration to prevent unauthorized account creation. Limit user permissions to prevent invoking internal helper functions. Monitor for unusual backend process terminations and unauthorized file access attempts.