Critical
Forged signed tokens let any registered user take over other users and organizations
Type: advisorySource: Official CVE List
Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data ta…
Products: postiz-appCVEs: CVE-2026-115933