CVE-2026-115933 is a critical authentication bypass vulnerability in GitroomHQ's postiz-app affecting versions from 2.15.0 up to but not including 2.25.3. The application uses a single shared secret to sign multiple types of tokens (session, invitation, password reset) without distinguishing token purposes. This flaw allows an attacker to craft a valid signed token with arbitrary claims, which the application accepts as legitimate for various sensitive operations including session authentication, organization invitations with chosen roles, password resets, and enterprise provisioning. A narrower related flaw affects team invitation creation. The vulnerability has a CVSS score of 9.9 and is fixed in version 2.25.3.
CVE-2026-115932 is a critical path traversal vulnerability in GitroomHQ's postiz-app affecting versions from 2.23.0 up to but not including 2.25.3. It allows a registered user to craft a media path that bypasses normal checks and causes the publishing worker to read arbitrary files on the server. These files can then be sent as attachments to a Discord server controlled by the attacker. Additional routes enable file existence checks and file delivery, potentially exhausting backend memory. Self-registration is enabled by default, so no prior account is needed to exploit this issue.
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface.
One of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed.
CVE-2026-107761 is a medium severity vulnerability in GitroomHQ's postiz-app where certain API endpoints expose sensitive data unnecessarily. The channel delete endpoint returns deleted integration rows including platform access and refresh tokens, allowing authorized third-party OAuth apps to misuse social platform credentials. The user organizations endpoint exposes organization API keys to all members, not just admins, enabling unauthorized API calls on behalf of the organization. Access to these endpoints requires valid authentication and is limited to the caller's own organization, preventing anonymous or cross-tenant access.
CVE-2026-94455 is a vulnerability in GitroomHQ's postiz-app allowing unauthenticated creation of enterprise organizations with elevated privileges. The affected HTTP endpoint lacks proper authentication checks, relying solely on a token signed with the instance secret but not verifying token purpose or expiry. This flaw permits an attacker with a valid user session token to create a new organization with the highest subscription tier and obtain its API key, which is immediately valid for API access.
Postiz-app versions before 2.4.0 generate security-sensitive credentials using a non-cryptographically secure pseudorandom number generator (Math.random()), exposing OAuth tokens and keys to compromise. An unauthenticated OAuth dynamic client registration endpoint leaks client credentials, enabling attackers to reconstruct the PRNG internal state and predict past and future credentials. This vulnerability has a critical severity with a CVSS score of 9.1.
Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw dot-segments are collapsed before routing, but URL-encoded separators survive route matching and are decoded only once they reach the handler, restoring the traversal at the filesystem call. An unauthenticated remote attacker can therefore read any file readable by the application process, including the process environment, which exposes the JWT signing secret, the database connection string, and connected provider and billing secrets. Because session tokens are signed with that secret and carry no expiry, this allows forging a non-expiring session as any user, including an administrator, without a password.