Vulnerability-Lookup

FKIE_CVE-2026-115933

Vulnerability from fkie_nvd - Published: 2026-10-24 15:17 - Updated: 2026-10-24 15:17

Severity

9.9 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token. A second, narrower route that creates team invitations signs extra fields from the request body in the same way.

References

	URL	Tags
	4cdc9741-f887-419a-a2fd-acbbd2729276	https://gadvisory.org/advisories/PSA-2026-YT2HMH
	4cdc9741-f887-419a-a2fd-acbbd2729276	https://github.com/gitroomhq/postiz-app
	4cdc9741-f887-419a-a2fd-acbbd2729276	https://github.com/gitroomhq/postiz-app/commit/a5affe62c74e39c1e7ac960d50d8418b807d532c
	4cdc9741-f887-419a-a2fd-acbbd2729276	https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "packageName": "postiz-app",
          "product": "postiz-app",
          "repo": "https://github.com/gitroomhq/postiz-app",
          "vendor": "GitroomHQ",
          "versions": [
            {
              "lessThan": "2.25.3",
              "status": "affected",
              "version": "2.15.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "4cdc9741-f887-419a-a2fd-acbbd2729276"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token.\n\nA second, narrower route that creates team invitations signs extra fields from the request body in the same way."
    }
  ],
  "id": "CVE-2026-115933",
  "lastModified": "2026-10-24T15:17:33.957",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0,
        "source": "4cdc9741-f887-419a-a2fd-acbbd2729276",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-10-24T15:17:33.957",
  "references": [
    {
      "source": "4cdc9741-f887-419a-a2fd-acbbd2729276",
      "url": "https://gadvisory.org/advisories/PSA-2026-YT2HMH"
    },
    {
      "source": "4cdc9741-f887-419a-a2fd-acbbd2729276",
      "url": "https://github.com/gitroomhq/postiz-app"
    },
    {
      "source": "4cdc9741-f887-419a-a2fd-acbbd2729276",
      "url": "https://github.com/gitroomhq/postiz-app/commit/a5affe62c74e39c1e7ac960d50d8418b807d532c"
    },
    {
      "source": "4cdc9741-f887-419a-a2fd-acbbd2729276",
      "url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3"
    }
  ],
  "sourceIdentifier": "4cdc9741-f887-419a-a2fd-acbbd2729276",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-290"
        },
        {
          "lang": "en",
          "value": "CWE-345"
        },
        {
          "lang": "en",
          "value": "CWE-915"
        }
      ],
      "source": "4cdc9741-f887-419a-a2fd-acbbd2729276",
      "type": "Secondary"
    }
  ]
}

CVE-2026-115933 (GCVE-0-2026-115933)

Vulnerability from cvelistv5 – Published: 2026-10-24 14:17 – Updated: 2026-10-24 14:29

Title

Forged signed tokens let any registered user take over other users and organizations

Summary

Severity

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE

Assigner

postiz CNA under the mitre root

CNA scorecard – unranked: 8 records in the last 180 days, 10 needed details

References

4 references

URL	Tags
https://github.com/gitroomhq/postiz-app	product
https://github.com/gitroomhq/postiz-app/releases/…	release-notes
https://github.com/gitroomhq/postiz-app/commit/a5…	patch
https://gadvisory.org/advisories/PSA-2026-YT2HMH	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
GitroomHQ	postiz-app	Affected: 2.15.0 , < 2.25.3 (semver)

Date Public

2026-10-24 14:16

Credits

Anthropic, PBC Enno Gelhaus Nevo David

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "postiz-app",
          "product": "postiz-app",
          "repo": "https://github.com/gitroomhq/postiz-app",
          "vendor": "GitroomHQ",
          "versions": [
            {
              "lessThan": "2.25.3",
              "status": "affected",
              "version": "2.15.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "The instance must be able to reach api2.skool.com, as any instance using the Skool provider can. No setting has to be changed."
        },
        {
          "lang": "en",
          "value": "With Stripe billing configured, the attacker\u0027s own plan must allow one channel and the target organization must not be on the STANDARD tier. The session and password reset tokens are not affected by these limits."
        },
        {
          "lang": "en",
          "value": "Self-registration is open unless DISABLE_REGISTRATION is set to true."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Anthropic, PBC"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Enno Gelhaus"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nevo David"
        }
      ],
      "datePublic": "2026-10-24T14:16:52.748Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token.\n\nA second, narrower route that creates team invitations signs extra fields from the request body in the same way."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "Exploitation was demonstrated end to end against an unmodified backend build at commit 3a7d28b7ad96: a second self-registered user became super administrator of another user\u0027s organization and read its API key. Session, password reset, enterprise and subscription tokens obtained the same way were each accepted by their endpoints."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "A registered user can obtain a validly signed token with claims of their choosing and use it as a login session for another user, without knowing any identifier of the victim when database filter objects are used as claims."
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker can join any other organization as super administrator, using an organization id that is exposed by any shared post preview link, read its API key and channel list and schedule posts through its connected social accounts."
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker can reset the password of a user whose id they know, and can obtain an organization with a lifetime top-tier subscription through the enterprise provisioning endpoint."
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Forged tokens do not expire and cannot be told apart from genuine ones."
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "The narrower invitation route lets a user who may invite team members repeatedly stop the scheduled posts of a channel of another organization, and lift the channel limit of their own plan."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-345",
              "description": "CWE-345",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-915",
              "description": "CWE-915",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T14:29:17.141Z",
        "orgId": "4cdc9741-f887-419a-a2fd-acbbd2729276",
        "shortName": "postiz"
      },
      "references": [
        {
          "name": "Postiz",
          "tags": [
            "product"
          ],
          "url": "https://github.com/gitroomhq/postiz-app"
        },
        {
          "name": "v2.25.3",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3"
        },
        {
          "name": "a5affe62",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/gitroomhq/postiz-app/commit/a5affe62c74e39c1e7ac960d50d8418b807d532c"
        },
        {
          "name": "GAdvisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://gadvisory.org/advisories/PSA-2026-YT2HMH"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-23T17:45:00.000Z",
          "value": "Anthropic has disclosed a thorough report of this vulnerability including a working PoC to Postiz"
        },
        {
          "lang": "en",
          "time": "2026-10-23T18:00:00.000Z",
          "value": "Postiz has reproduced the vulnerability and is working on a fix"
        },
        {
          "lang": "en",
          "time": "2026-10-24T13:27:00.000Z",
          "value": "Postiz has pushed a fix for this vulnerability and verified it"
        },
        {
          "lang": "en",
          "time": "2026-10-24T14:18:00.000Z",
          "value": "Postiz has created a release and published the advisory"
        }
      ],
      "title": "Forged signed tokens let any registered user take over other users and organizations",
      "workarounds": [
        {
          "lang": "en",
          "value": "If you do not use channels that rely on the Postiz browser extension, block POST /integrations/extension-refresh at your reverse proxy. This removes the main signing route; the team invitation route remains."
        },
        {
          "lang": "en",
          "value": "Set DISABLE_REGISTRATION=true. The attacker needs an ordinary account, so closing self-registration limits exposure to people who already hold one. This reduces reach, it does not close the issue."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4cdc9741-f887-419a-a2fd-acbbd2729276",
    "assignerShortName": "postiz",
    "cveId": "CVE-2026-115933",
    "datePublished": "2026-10-24T14:17:05.755Z",
    "dateReserved": "2026-10-23T21:21:06.893Z",
    "dateUpdated": "2026-10-24T14:29:17.141Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted