Vulnerabilities

TI-2026-63437 CVE-2026-94455

Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key

LOW 31

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00263 Published 2026-09-22 Fixed in 2.4.0 CWE-1390

TI-2026-63438 CVE-2026-94456

MEDIUM 48

Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00522 Published 2026-09-22 Fixed in 2.4.0 CWE-330