The vulnerability (CVE-2026-42298) in gitroomhq's postiz-app is an improper control of code generation (CWE-94) in the Build and Publish PR Docker Image workflow. Specifically, before commit da44801, an unauthenticated attacker could submit a Pull Request from a fork containing a malicious Dockerfile.dev, enabling arbitrary code execution during the Docker build process. This exploit allows theft of a GITHUB_TOKEN with write-all permissions, posing a severe risk to repository integrity and confidentiality. The issue has been fixed in commit da44801.

Successful exploitation allows unauthenticated attackers to execute arbitrary code in the Docker build environment and exfiltrate a GITHUB_TOKEN with full write permissions. This compromises repository security, enabling unauthorized code changes, data theft, and potential further attacks on the CI/CD pipeline or associated infrastructure. The CVSS 3.1 score of 10.0 reflects the critical nature and complete impact on confidentiality, integrity, and availability.

This vulnerability has been patched in commit da44801. Users should update postiz-app to versions including this commit or later to remediate the issue. Since this is not a cloud service, manual patching is required. There is no vendor advisory content contradicting this; therefore, applying the official fix is the recommended mitigation.