Read the docs
TI-2026-63437 Aliases CVE-2026-94455

Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key

Priority LOW 31CWE-1390Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Denial of service
Confidentiality · integrity · availability
None · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306 and CWE-770.

Summary

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The endpoint's only check is that the request body carries a token bearing a valid signature from the instance secret. It does not check what that token was issued for. Login tokens are signed with the same secret and carry no purpose, audience or expiry claim, so an ordinary user's own session token satisfies the check. Presented with such a token, the endpoint creates a new organisation holding the highest subscription tier, flagged as lifetime and with a channel allowance far above any sold plan, creates an organisation-owner account alongside it, and returns the new organisation's API key in the response body. That key is immediately valid against the public API.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00263 18th percentileScored 2026-11-07
Fix Fixed postiz-app (GitroomHQ): 2.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gitroomhqpostiz-appbefore 2.4.02.4.0Patch availableCNA
  • postiz-app Vendorgitroomhq Affected before 2.4.0 Fixed in 2.4.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:gitroom:postiz:*:*:*:*:*:*:*:*——gitroomhq
  • cpe:2.3:a:gitroom:postiz:*:*:*:*:*:*:*:* Versions — — ·gitroomhq

Remediation

  • Fix · CNA postiz-app (GitroomHQ) Fixed in 2.4.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    GitroomHQ postiz-app 2.4.0

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-63438 Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization…Priority MEDIUM 48
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-94455

References

Patch 1

Advisory 1

Other 2

  • TI-2026-26825 Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check CVSS 3.1HIGH 8.6
  • TI-2026-28982 Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream CVSS 3.1HIGH 8.2
  • TI-2026-29238 Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS CVSS 3.1CRITICAL 9.0
  • TI-2026-26824 Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata CVSS 4.0HIGH 8.3
  • TI-2026-26837 Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation CVSS 3.1MEDIUM 5.4
  • TI-2026-15715 Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover CVSS 4.0CRITICAL 9.3
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences