Threat Intelligence Database

Postiz, an AI social media scheduling tool by gitroomhq, had a vulnerability in versions prior to 2.21.8 where an unauthenticated endpoint accepted a signed token without verifying its intended purpose. This allowed attackers to trigger subscription-enforcement side effects on their own organization, such as adjusting team-member enablement, disabling integrations, and resetting scheduled-post cron jobs. The vulnerability did not allow changing the subscription tier or affecting other organizations. The issue was fixed in version 2.21.8.

Postiz, an AI social media scheduling tool by gitroomhq, contains a critical authentication bypass vulnerability (CVE-2026-48781) in versions prior to 2.21.8. The issue arises from the Skool integration callback signing attacker-controlled JSON data into a session JWT using the app's JWT_SECRET. The authentication middleware trusts all JWT claims without revalidating the user against the database, allowing any authenticated user to forge a SUPERADMIN session and impersonate organizations. This grants full access to all Postiz features, including posting on behalf of victim social media accounts. The vulnerability is fixed in version 2.21.8.