gitroomhq

Records20All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical9CVSS 9.0–10.0

CVSS high6CVSS 7.0–8.9

Exploited now

gitroomhq records in CISA KEV

No gitroomhq vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Postiz 7 records HIGH

Records

20 records

TI-2026-26825 CVE-2026-34577

Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check

HIGH 76

Postiz is an AI social media scheduling tool.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00482 Published 2026-04-02 Fixed in 2.21.3 CWE-918

TI-2026-28982 CVE-2026-40168

Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream

HIGH 75

Postiz is an AI social media scheduling tool.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00386 Published 2026-04-10 Fixed in 2.21.5 CWE-918

TI-2026-29238 CVE-2026-40487

Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS

HIGH 74

Postiz is an AI social media scheduling tool.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00224 Published 2026-04-18 Fixed in 2.21.6 CWE-345

TI-2026-26824 CVE-2026-34576

Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata

HIGH 69

Postiz is an AI social media scheduling tool.

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00272 Published 2026-04-02 Fixed in 2.21.3 CWE-918

TI-2026-26837 CVE-2026-34590

Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation

MEDIUM 58

Postiz is an AI social media scheduling tool.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00234 Published 2026-04-02 Fixed in 2.21.4 CWE-918

TI-2026-15715 CVE-2026-19264 · GHSA-2p7p-3c9x-rwxm

Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

MEDIUM 50

Postiz is an open-source social media scheduling tool.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01013 Published 2026-08-07 Fixed in 2.22.1 CWE-22

TI-2026-30607 CVE-2026-42298

Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev

MEDIUM 49

Postiz is an AI social media scheduling tool.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00504 Published 2026-05-08 No fix listed CWE-94

TI-2026-63438 CVE-2026-94456

Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization…

MEDIUM 48

Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00522 Published 2026-09-22 Fixed in 2.4.0 CWE-330

TI-2026-80073 CVE-2026-115932 · GHSA-rmc2-p2gv-m88f

Path traversal in Postiz lets registered users read server files

MEDIUM 43

When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00428 Published 2026-10-24 Fixed in 2.25.3 CWE-22

TI-2026-80009 CVE-2026-115931 · GHSA-h5r5-h782-vqvp

Arbitrary file read in Postiz via unrestricted provider method calls

MEDIUM 43

Postiz lets a signed-in user ask the backend to run a function on one of their connected channels.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00485 Published 2026-10-23 Fixed in 2.25.2 CWE-470

TI-2026-80074 CVE-2026-115933 · GHSA-9j6f-8rw3-93c4

Forged signed tokens in Postiz let users take over other accounts

MEDIUM 42

Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00249 Published 2026-10-24 Fixed in 2.25.3 CWE-290

TI-2026-36051 CVE-2026-48781

Postiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgery

MEDIUM 42

Postiz is an AI social media scheduling tool.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00209 Published 2026-06-16 Fixed in 2.21.8 CWE-302

TI-2025-33567 CVE-2025-53641

Postiz allows header mutation in middleware facilitates resulting in SSRF

MEDIUM 41

Postiz is an AI social media scheduling tool.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00281 Published 2025-07-11 Fixed in 1.62.3 CWE-918

TI-2026-30836 CVE-2026-42556

Postiz stored XSS in public preview page

MEDIUM 40

Postiz is an AI social media scheduling tool.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00258 Published 2026-05-08 Fixed in 2.21.7 CWE-79

TI-2026-36069 CVE-2026-48799

Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook

LOW 33

Postiz is an AI social media scheduling tool.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00218 Published 2026-07-15 Fixed in 2.21.8 CWE-345

TI-2026-63437 CVE-2026-94455

Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key

LOW 31

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00263 Published 2026-09-22 Fixed in 2.4.0 CWE-1390

TI-2026-15619 CVE-2026-19127

Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions

LOW 29

An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00307 Published 2026-08-06 Fixed in 2.21.10 CWE-345

TI-2026-30649 CVE-2026-42346

Postiz: TOCTOU DNS rebinding bypasses all SSRF URL validation paths

LOW 28

Postiz is an AI social media scheduling tool.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00224 Published 2026-05-08 Fixed in 2.21.7 CWE-918

TI-2026-70784 CVE-2026-107761 · GHSA-wm8w-ph5r-v9cm

Postiz API responses expose channel tokens and organization API key

LOW 24

Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00283 Published 2026-10-11 Fixed in 2.25.1 CWE-201

TI-2026-36053 CVE-2026-48783

Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription

LOW 21

Postiz is an AI social media scheduling tool.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.0017 Published 2026-06-16 Fixed in 2.21.8 CWE-345

Open these records in search →

Critical	9
High	6
Medium	5
Low	0
No CVSS	0