{"schema_version":"2","view":"grouped","data":[{"id":56302,"cve_ids":["CVE-2026-115933"],"payload":{"kind":"advisory","title":"Forged signed tokens let any registered user take over other users and organizations","summary":"Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token. A second, narrower route that creates team invitations signs extra fields from the request body in the same way.","evidence":"cve:CVE-2026-115933","products":[{"name":{"value":"postiz-app","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-115933","aliases":["CVE-2026-115933"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":9.9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}}],"affected":[{"repo":"https://github.com/gitroomhq/postiz-app","vendor":"GitroomHQ","product":"postiz-app","versions":[{"status":"affected","version":"2.15.0","lessThan":"2.25.3","versionType":"semver"}],"packageName":"postiz-app","defaultStatus":"unaffected"}],"modified":"2026-10-24T14:29:17.141Z","provider":"cve","references":["https://github.com/gitroomhq/postiz-app","https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3","https://github.com/gitroomhq/postiz-app/commit/a5affe62c74e39c1e7ac960d50d8418b807d532c","https://gadvisory.org/advisories/PSA-2026-YT2HMH"],"provider_metadata":{"cna":{"orgId":"4cdc9741-f887-419a-a2fd-acbbd2729276","shortName":"postiz","dateUpdated":"2026-10-24T14:29:17.141Z"}}},"related_cves":[{"value":"CVE-2026-115933","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:720093da-af9d-407f-ac18-01b5e616f07d","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115933","advisory_id":"720093da-af9d-407f-ac18-01b5e616f07d","event_types":["advisory"],"published_at":"2026-10-25T16:12:35.544794+00:00","technologies":["core-cve","postiz-app"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T14:17:05.755+00:00","detail_url":"/advisories/advisory%3A720093da-af9d-407f-ac18-01b5e616f07d","group":{"id":"advisory:720093da-af9d-407f-ac18-01b5e616f07d","revision":1,"primary_event_id":55825,"change":"published","superseded_by":[],"changed":{"id":55825,"cve_ids":["CVE-2026-115933"],"payload":{"kind":"advisory","title":"Forged signed tokens let any registered user take over other users and organizations","summary":"Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token. A second, narrower route that creates team invitations signs extra fields from the request body in the same way.","evidence":"cve:CVE-2026-115933","products":[{"name":{"value":"postiz-app","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-115933","aliases":["CVE-2026-115933"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":9.9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}}],"affected":[{"repo":"https://github.com/gitroomhq/postiz-app","vendor":"GitroomHQ","product":"postiz-app","versions":[{"status":"affected","version":"2.15.0","lessThan":"2.25.3","versionType":"semver"}],"packageName":"postiz-app","defaultStatus":"unaffected"}],"modified":"2026-10-24T14:29:17.141Z","provider":"cve","references":["https://github.com/gitroomhq/postiz-app","https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3","https://github.com/gitroomhq/postiz-app/commit/a5affe62c74e39c1e7ac960d50d8418b807d532c","https://gadvisory.org/advisories/PSA-2026-YT2HMH"],"provider_metadata":{"cna":{"orgId":"4cdc9741-f887-419a-a2fd-acbbd2729276","shortName":"postiz","dateUpdated":"2026-10-24T14:29:17.141Z"}}},"related_cves":[{"value":"CVE-2026-115933","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:720093da-af9d-407f-ac18-01b5e616f07d","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115933","advisory_id":"720093da-af9d-407f-ac18-01b5e616f07d","event_types":["advisory"],"published_at":"2026-10-25T16:12:35.544794+00:00","technologies":["core-cve","postiz-app"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T14:17:05.755+00:00","detail_url":"/events/55825"},"members":[{"id":55825,"cve_ids":["CVE-2026-115933"],"payload":{"kind":"advisory","title":"Forged signed tokens let any registered user take over other users and organizations","summary":"Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token. A second, narrower route that creates team invitations signs extra fields from the request body in the same way.","evidence":"cve:CVE-2026-115933","products":[{"name":{"value":"postiz-app","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-115933","aliases":["CVE-2026-115933"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":9.9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}}],"affected":[{"repo":"https://github.com/gitroomhq/postiz-app","vendor":"GitroomHQ","product":"postiz-app","versions":[{"status":"affected","version":"2.15.0","lessThan":"2.25.3","versionType":"semver"}],"packageName":"postiz-app","defaultStatus":"unaffected"}],"modified":"2026-10-24T14:29:17.141Z","provider":"cve","references":["https://github.com/gitroomhq/postiz-app","https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3","https://github.com/gitroomhq/postiz-app/commit/a5affe62c74e39c1e7ac960d50d8418b807d532c","https://gadvisory.org/advisories/PSA-2026-YT2HMH"],"provider_metadata":{"cna":{"orgId":"4cdc9741-f887-419a-a2fd-acbbd2729276","shortName":"postiz","dateUpdated":"2026-10-24T14:29:17.141Z"}}},"related_cves":[{"value":"CVE-2026-115933","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:720093da-af9d-407f-ac18-01b5e616f07d","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115933","advisory_id":"720093da-af9d-407f-ac18-01b5e616f07d","event_types":["advisory"],"published_at":"2026-10-25T16:12:35.544794+00:00","technologies":["core-cve","postiz-app"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T14:17:05.755+00:00","detail_url":"/events/55825"}]}}],"next_after":56302,"next_before":56302}