Threats Tagged 'ghsa-wm8w-ph5r-v9cm'

CVE-2026-107761 is a medium severity vulnerability in GitroomHQ's postiz-app where certain API endpoints expose sensitive data unnecessarily. The channel delete endpoint returns deleted integration rows including platform access and refresh tokens, allowing authorized third-party OAuth apps to misuse social platform credentials. The user organizations endpoint exposes organization API keys to all members, not just admins, enabling unauthorized API calls on behalf of the organization. Access to these endpoints requires valid authentication and is limited to the caller's own organization, preventing anonymous or cross-tenant access.