Forged signed tokens in Postiz let users take over other accounts
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass, Tampering
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-290 and CWE-915.
Summary
Postiz from GitroomHQ (postiz-app) from 2.15.0 before 2.25.3 signs session, invitation and password reset tokens with one shared secret and no marker of their purpose. A route that refreshes browser-extension channel credentials signs data from the request, so any registered user can forge a valid token with chosen claims (CWE-345). The application accepts such tokens as sessions, invitations with a chosen role, password resets or enterprise provisioning tokens.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token. A second, narrower route that creates team invitations signs extra fields from the request body in the same way.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade postiz-app to version 2.25.3, the fixed version.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
- Fix · CNA postiz-app (GitroomHQ) Fixed in 2.25.3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
GitroomHQ postiz-app 2.25.3
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2026-80073 Path traversal in Postiz lets registered users read server filesPriority MEDIUM 43
Timeline
- 2026-10-24 Threatist record created from CVE-2026-115933
- 2026-10-24 Alias added: GHSA-9j6f-8rw3-93c4
- 2026-11-02 CISA SSVC decision points changed
More gitroomhq vulnerabilities
- TI-2026-26825 Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check CVSS 3.1HIGH 8.6
- TI-2026-28982 Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream CVSS 3.1HIGH 8.2
- TI-2026-29238 Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS CVSS 3.1CRITICAL 9.0
- TI-2026-26824 Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata CVSS 4.0HIGH 8.3
- TI-2026-26837 Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation CVSS 3.1MEDIUM 5.4
- TI-2026-15715 Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover CVSS 4.0CRITICAL 9.3
Sources
- CVE-2026-115933 · CVE Program
- CVE-2026-115933 · NVD
- FIRST EPSS
- GHSA-9j6f-8rw3-93c4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences