Vulnerabilities

TI-2026-80074 CVE-2026-115933 · GHSA-9j6f-8rw3-93c4

Forged signed tokens in Postiz let users take over other accounts

MEDIUM 42

Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00249 Published 2026-10-24 Fixed in 2.25.3 CWE-290

TI-2026-80073 CVE-2026-115932 · GHSA-rmc2-p2gv-m88f

Path traversal in Postiz lets registered users read server files

MEDIUM 43

When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00428 Published 2026-10-24 Fixed in 2.25.3 CWE-22

TI-2026-80009 CVE-2026-115931 · GHSA-h5r5-h782-vqvp

Arbitrary file read in Postiz via unrestricted provider method calls

MEDIUM 43

Postiz lets a signed-in user ask the backend to run a function on one of their connected channels.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00485 Published 2026-10-23 Fixed in 2.25.2 CWE-470

TI-2026-70784 CVE-2026-107761 · GHSA-wm8w-ph5r-v9cm

Postiz API responses expose channel tokens and organization API key

LOW 24

Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00283 Published 2026-10-11 Fixed in 2.25.1 CWE-201

TI-2026-63437 CVE-2026-94455

Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key

LOW 31

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00263 Published 2026-09-22 Fixed in 2.4.0 CWE-1390

TI-2026-63438 CVE-2026-94456

Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization…

MEDIUM 48

Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00522 Published 2026-09-22 Fixed in 2.4.0 CWE-330

TI-2026-15715 CVE-2026-19264 · GHSA-2p7p-3c9x-rwxm

Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

MEDIUM 50

Postiz is an open-source social media scheduling tool.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01013 Published 2026-08-07 Fixed in 2.22.1 CWE-22

TI-2026-15619 CVE-2026-19127

Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions

LOW 29

An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00307 Published 2026-08-06 Fixed in 2.21.10 CWE-345

TI-2026-36069 CVE-2026-48799