{"schema_version":"2","view":"grouped","data":[{"id":56302,"cve_ids":["CVE-2026-115933"],"payload":{"kind":"advisory","title":"Forged signed tokens let any registered user take over other users and organizations","summary":"Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token. A second, narrower route that creates team invitations signs extra fields from the request body in the same way.","evidence":"cve:CVE-2026-115933","products":[{"name":{"value":"postiz-app","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-115933","aliases":["CVE-2026-115933"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":9.9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}}],"affected":[{"repo":"https://github.com/gitroomhq/postiz-app","vendor":"GitroomHQ","product":"postiz-app","versions":[{"status":"affected","version":"2.15.0","lessThan":"2.25.3","versionType":"semver"}],"packageName":"postiz-app","defaultStatus":"unaffected"}],"modified":"2026-10-24T14:29:17.141Z","provider":"cve","references":["https://github.com/gitroomhq/postiz-app","https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3","https://github.com/gitroomhq/postiz-app/commit/a5affe62c74e39c1e7ac960d50d8418b807d532c","https://gadvisory.org/advisories/PSA-2026-YT2HMH"],"provider_metadata":{"cna":{"orgId":"4cdc9741-f887-419a-a2fd-acbbd2729276","shortName":"postiz","dateUpdated":"2026-10-24T14:29:17.141Z"}}},"related_cves":[{"value":"CVE-2026-115933","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:720093da-af9d-407f-ac18-01b5e616f07d","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115933","advisory_id":"720093da-af9d-407f-ac18-01b5e616f07d","event_types":["advisory"],"published_at":"2026-10-25T16:12:35.544794+00:00","technologies":["core-cve","postiz-app"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T14:17:05.755+00:00","detail_url":"/advisories/advisory%3A720093da-af9d-407f-ac18-01b5e616f07d","group":{"id":"advisory:720093da-af9d-407f-ac18-01b5e616f07d","revision":1,"primary_event_id":55825,"change":"published","superseded_by":[],"changed":{"id":55825,"cve_ids":["CVE-2026-115933"],"payload":{"kind":"advisory","title":"Forged signed tokens let any registered user take over other users and organizations","summary":"Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token. A second, narrower route that creates team invitations signs extra fields from the request body in the same way.","evidence":"cve:CVE-2026-115933","products":[{"name":{"value":"postiz-app","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-115933","aliases":["CVE-2026-115933"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":9.9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}}],"affected":[{"repo":"https://github.com/gitroomhq/postiz-app","vendor":"GitroomHQ","product":"postiz-app","versions":[{"status":"affected","version":"2.15.0","lessThan":"2.25.3","versionType":"semver"}],"packageName":"postiz-app","defaultStatus":"unaffected"}],"modified":"2026-10-24T14:29:17.141Z","provider":"cve","references":["https://github.com/gitroomhq/postiz-app","https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3","https://github.com/gitroomhq/postiz-app/commit/a5affe62c74e39c1e7ac960d50d8418b807d532c","https://gadvisory.org/advisories/PSA-2026-YT2HMH"],"provider_metadata":{"cna":{"orgId":"4cdc9741-f887-419a-a2fd-acbbd2729276","shortName":"postiz","dateUpdated":"2026-10-24T14:29:17.141Z"}}},"related_cves":[{"value":"CVE-2026-115933","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:720093da-af9d-407f-ac18-01b5e616f07d","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115933","advisory_id":"720093da-af9d-407f-ac18-01b5e616f07d","event_types":["advisory"],"published_at":"2026-10-25T16:12:35.544794+00:00","technologies":["core-cve","postiz-app"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T14:17:05.755+00:00","detail_url":"/events/55825"},"members":[{"id":55825,"cve_ids":["CVE-2026-115933"],"payload":{"kind":"advisory","title":"Forged signed tokens let any registered user take over other users and organizations","summary":"Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token. A second, narrower route that creates team invitations signs extra fields from the request body in the same way.","evidence":"cve:CVE-2026-115933","products":[{"name":{"value":"postiz-app","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-115933","aliases":["CVE-2026-115933"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":9.9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}}],"affected":[{"repo":"https://github.com/gitroomhq/postiz-app","vendor":"GitroomHQ","product":"postiz-app","versions":[{"status":"affected","version":"2.15.0","lessThan":"2.25.3","versionType":"semver"}],"packageName":"postiz-app","defaultStatus":"unaffected"}],"modified":"2026-10-24T14:29:17.141Z","provider":"cve","references":["https://github.com/gitroomhq/postiz-app","https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3","https://github.com/gitroomhq/postiz-app/commit/a5affe62c74e39c1e7ac960d50d8418b807d532c","https://gadvisory.org/advisories/PSA-2026-YT2HMH"],"provider_metadata":{"cna":{"orgId":"4cdc9741-f887-419a-a2fd-acbbd2729276","shortName":"postiz","dateUpdated":"2026-10-24T14:29:17.141Z"}}},"related_cves":[{"value":"CVE-2026-115933","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:720093da-af9d-407f-ac18-01b5e616f07d","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115933","advisory_id":"720093da-af9d-407f-ac18-01b5e616f07d","event_types":["advisory"],"published_at":"2026-10-25T16:12:35.544794+00:00","technologies":["core-cve","postiz-app"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T14:17:05.755+00:00","detail_url":"/events/55825"}]}},{"id":56301,"cve_ids":["CVE-2026-115932"],"payload":{"kind":"advisory","title":"Path traversal in post media lets any registered user read server files","summary":"When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls. The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.","evidence":"cve:CVE-2026-115932","products":[{"name":{"value":"postiz-app","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-115932","aliases":["CVE-2026-115932"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":9.6,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"}}],"affected":[{"repo":"https://github.com/gitroomhq/postiz-app","vendor":"GitroomHQ","product":"postiz-app","versions":[{"status":"affected","version":"2.23.0","lessThan":"2.25.3","versionType":"semver"}],"packageName":"postiz-app","defaultStatus":"unaffected"}],"modified":"2026-10-24T14:18:20.861Z","provider":"cve","references":["https://github.com/gitroomhq/postiz-app","https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3","https://github.com/gitroomhq/postiz-app/commit/12db9bd2f428b628a62809669c3d76297e07750a","https://gadvisory.org/advisories/PSA-2026-E9AHFV"],"provider_metadata":{"cna":{"orgId":"4cdc9741-f887-419a-a2fd-acbbd2729276","shortName":"postiz","dateUpdated":"2026-10-24T14:18:20.861Z"}}},"related_cves":[{"value":"CVE-2026-115932","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:98cb3ce1-f93f-4c3b-b0f9-e7390d0ba34b","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115932","advisory_id":"98cb3ce1-f93f-4c3b-b0f9-e7390d0ba34b","event_types":["advisory"],"published_at":"2026-10-25T16:12:34.648264+00:00","technologies":["core-cve","postiz-app"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T12:28:36.033+00:00","detail_url":"/advisories/advisory%3A98cb3ce1-f93f-4c3b-b0f9-e7390d0ba34b","group":{"id":"advisory:98cb3ce1-f93f-4c3b-b0f9-e7390d0ba34b","revision":1,"primary_event_id":55824,"change":"published","superseded_by":[],"changed":{"id":55824,"cve_ids":["CVE-2026-115932"],"payload":{"kind":"advisory","title":"Path traversal in post media lets any registered user read server files","summary":"When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls. The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.","evidence":"cve:CVE-2026-115932","products":[{"name":{"value":"postiz-app","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-115932","aliases":["CVE-2026-115932"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":9.6,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"}}],"affected":[{"repo":"https://github.com/gitroomhq/postiz-app","vendor":"GitroomHQ","product":"postiz-app","versions":[{"status":"affected","version":"2.23.0","lessThan":"2.25.3","versionType":"semver"}],"packageName":"postiz-app","defaultStatus":"unaffected"}],"modified":"2026-10-24T14:18:20.861Z","provider":"cve","references":["https://github.com/gitroomhq/postiz-app","https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3","https://github.com/gitroomhq/postiz-app/commit/12db9bd2f428b628a62809669c3d76297e07750a","https://gadvisory.org/advisories/PSA-2026-E9AHFV"],"provider_metadata":{"cna":{"orgId":"4cdc9741-f887-419a-a2fd-acbbd2729276","shortName":"postiz","dateUpdated":"2026-10-24T14:18:20.861Z"}}},"related_cves":[{"value":"CVE-2026-115932","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:98cb3ce1-f93f-4c3b-b0f9-e7390d0ba34b","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115932","advisory_id":"98cb3ce1-f93f-4c3b-b0f9-e7390d0ba34b","event_types":["advisory"],"published_at":"2026-10-25T16:12:34.648264+00:00","technologies":["core-cve","postiz-app"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T12:28:36.033+00:00","detail_url":"/events/55824"},"members":[{"id":55824,"cve_ids":["CVE-2026-115932"],"payload":{"kind":"advisory","title":"Path traversal in post media lets any registered user read server files","summary":"When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls. The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.","evidence":"cve:CVE-2026-115932","products":[{"name":{"value":"postiz-app","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-115932","aliases":["CVE-2026-115932"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":9.6,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"}}],"affected":[{"repo":"https://github.com/gitroomhq/postiz-app","vendor":"GitroomHQ","product":"postiz-app","versions":[{"status":"affected","version":"2.23.0","lessThan":"2.25.3","versionType":"semver"}],"packageName":"postiz-app","defaultStatus":"unaffected"}],"modified":"2026-10-24T14:18:20.861Z","provider":"cve","references":["https://github.com/gitroomhq/postiz-app","https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3","https://github.com/gitroomhq/postiz-app/commit/12db9bd2f428b628a62809669c3d76297e07750a","https://gadvisory.org/advisories/PSA-2026-E9AHFV"],"provider_metadata":{"cna":{"orgId":"4cdc9741-f887-419a-a2fd-acbbd2729276","shortName":"postiz","dateUpdated":"2026-10-24T14:18:20.861Z"}}},"related_cves":[{"value":"CVE-2026-115932","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:98cb3ce1-f93f-4c3b-b0f9-e7390d0ba34b","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115932","advisory_id":"98cb3ce1-f93f-4c3b-b0f9-e7390d0ba34b","event_types":["advisory"],"published_at":"2026-10-25T16:12:34.648264+00:00","technologies":["core-cve","postiz-app"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T12:28:36.033+00:00","detail_url":"/events/55824"}]}},{"id":56275,"cve_ids":["CVE-2026-115931"],"payload":{"kind":"advisory","title":"Arbitrary file read and backend crash through unrestricted provider method calls","summary":"Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface. One of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed.","evidence":"cve:CVE-2026-115931","products":[{"name":{"value":"postiz-app","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-115931","aliases":["CVE-2026-115931"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":9.9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}}],"affected":[{"repo":"https://github.com/gitroomhq/postiz-app","vendor":"GitroomHQ","product":"postiz-app","versions":[{"status":"affected","version":"2.23.0","lessThan":"2.25.2","versionType":"semver"}],"packageName":"postiz-app","defaultStatus":"unaffected"}],"modified":"2026-10-24T14:28:58.123Z","provider":"cve","references":["https://github.com/gitroomhq/postiz-app","https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.2","https://github.com/gitroomhq/postiz-app/commit/9383f5be4d310c346e33a3748a9a7ded64c96fed","https://gadvisory.org/advisories/PSA-2026-JNXM56"],"provider_metadata":{"cna":{"orgId":"4cdc9741-f887-419a-a2fd-acbbd2729276","shortName":"postiz","dateUpdated":"2026-10-24T14:28:58.123Z"}}},"related_cves":[{"value":"CVE-2026-115931","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ab0132cf-0705-48e4-b44f-ab4d8000ccff","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115931","advisory_id":"ab0132cf-0705-48e4-b44f-ab4d8000ccff","event_types":["advisory"],"published_at":"2026-10-25T16:11:25.603579+00:00","technologies":["core-cve","postiz-app"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T22:02:21.717+00:00","detail_url":"/advisories/advisory%3Aab0132cf-0705-48e4-b44f-ab4d8000ccff","group":{"id":"advisory:ab0132cf-0705-48e4-b44f-ab4d8000ccff","revision":1,"primary_event_id":55799,"change":"published","superseded_by":[],"changed":{"id":55799,"cve_ids":["CVE-2026-115931"],"payload":{"kind":"advisory","title":"Arbitrary file read and backend crash through unrestricted provider method calls","summary":"Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface. One of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed.","evidence":"cve:CVE-2026-115931","products":[{"name":{"value":"postiz-app","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-115931","aliases":["CVE-2026-115931"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":9.9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}}],"affected":[{"repo":"https://github.com/gitroomhq/postiz-app","vendor":"GitroomHQ","product":"postiz-app","versions":[{"status":"affected","version":"2.23.0","lessThan":"2.25.2","versionType":"semver"}],"packageName":"postiz-app","defaultStatus":"unaffected"}],"modified":"2026-10-24T14:28:58.123Z","provider":"cve","references":["https://github.com/gitroomhq/postiz-app","https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.2","https://github.com/gitroomhq/postiz-app/commit/9383f5be4d310c346e33a3748a9a7ded64c96fed","https://gadvisory.org/advisories/PSA-2026-JNXM56"],"provider_metadata":{"cna":{"orgId":"4cdc9741-f887-419a-a2fd-acbbd2729276","shortName":"postiz","dateUpdated":"2026-10-24T14:28:58.123Z"}}},"related_cves":[{"value":"CVE-2026-115931","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ab0132cf-0705-48e4-b44f-ab4d8000ccff","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115931","advisory_id":"ab0132cf-0705-48e4-b44f-ab4d8000ccff","event_types":["advisory"],"published_at":"2026-10-25T16:11:25.603579+00:00","technologies":["core-cve","postiz-app"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T22:02:21.717+00:00","detail_url":"/events/55799"},"members":[{"id":55799,"cve_ids":["CVE-2026-115931"],"payload":{"kind":"advisory","title":"Arbitrary file read and backend crash through unrestricted provider method calls","summary":"Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface. One of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed.","evidence":"cve:CVE-2026-115931","products":[{"name":{"value":"postiz-app","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-115931","aliases":["CVE-2026-115931"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":9.9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}}],"affected":[{"repo":"https://github.com/gitroomhq/postiz-app","vendor":"GitroomHQ","product":"postiz-app","versions":[{"status":"affected","version":"2.23.0","lessThan":"2.25.2","versionType":"semver"}],"packageName":"postiz-app","defaultStatus":"unaffected"}],"modified":"2026-10-24T14:28:58.123Z","provider":"cve","references":["https://github.com/gitroomhq/postiz-app","https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.2","https://github.com/gitroomhq/postiz-app/commit/9383f5be4d310c346e33a3748a9a7ded64c96fed","https://gadvisory.org/advisories/PSA-2026-JNXM56"],"provider_metadata":{"cna":{"orgId":"4cdc9741-f887-419a-a2fd-acbbd2729276","shortName":"postiz","dateUpdated":"2026-10-24T14:28:58.123Z"}}},"related_cves":[{"value":"CVE-2026-115931","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ab0132cf-0705-48e4-b44f-ab4d8000ccff","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115931","advisory_id":"ab0132cf-0705-48e4-b44f-ab4d8000ccff","event_types":["advisory"],"published_at":"2026-10-25T16:11:25.603579+00:00","technologies":["core-cve","postiz-app"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T22:02:21.717+00:00","detail_url":"/events/55799"}]}},{"id":30206,"cve_ids":["CVE-2026-107761"],"payload":{"kind":"advisory","title":"Channel tokens and organization API key exposed in API responses","summary":"Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the caller is not meant to receive. The public API's channel delete returns the deleted integration row, including the channel's platform access token and refresh token. A third-party OAuth app permitted to delete a channel therefore receives that channel's social platform credentials and can use them against the connected account directly, outside Postiz. `GET /user/organizations` returns each organization row, including its API key, to every member of the organization. The API key is intended for admins only, so a member with a lower role can obtain it and call the public API on behalf of the organization. Both endpoints require a valid session, API key or OAuth token and are scoped to the caller's own organization. There is no anonymous access and no cross-tenant exposure.","evidence":"cve:CVE-2026-107761","products":[{"name":{"value":"postiz-app","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-107761","aliases":["CVE-2026-107761"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N"}}],"affected":[{"repo":"https://github.com/gitroomhq/postiz-app","vendor":"GitroomHQ","product":"postiz-app","versions":[{"status":"affected","version":"0","lessThan":"2.25.1","versionType":"semver"}],"packageName":"postiz-app","defaultStatus":"unaffected"}],"modified":"2026-10-15T18:09:42.965Z","provider":"cve","references":["https://github.com/gitroomhq/postiz-app/commit/8ad0df3df0f21299b8640568358c1b68c6464e4f","https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.1","https://gadvisory.org/advisories/PSA-2026-4QX1WG"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-107761","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T17:51:22.688318Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T18:09:42.965Z"}}],"cna":{"orgId":"4cdc9741-f887-419a-a2fd-acbbd2729276","shortName":"postiz","dateUpdated":"2026-10-11T15:24:16.835Z"}}},"related_cves":[{"value":"CVE-2026-107761","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e395c738-fe10-4737-8380-995bd0f7b462","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107761","advisory_id":"e395c738-fe10-4737-8380-995bd0f7b462","event_types":["advisory"],"published_at":"2026-10-25T08:07:57.096831+00:00","technologies":["core-cve","postiz-app"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-11T15:23:15.196+00:00","detail_url":"/advisories/advisory%3Ae395c738-fe10-4737-8380-995bd0f7b462","group":{"id":"advisory:e395c738-fe10-4737-8380-995bd0f7b462","revision":1,"primary_event_id":29962,"change":"published","superseded_by":[],"changed":{"id":29962,"cve_ids":["CVE-2026-107761"],"payload":{"kind":"advisory","title":"Channel tokens and organization API key exposed in API responses","summary":"Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the caller is not meant to receive. The public API's channel delete returns the deleted integration row, including the channel's platform access token and refresh token. A third-party OAuth app permitted to delete a channel therefore receives that channel's social platform credentials and can use them against the connected account directly, outside Postiz. `GET /user/organizations` returns each organization row, including its API key, to every member of the organization. The API key is intended for admins only, so a member with a lower role can obtain it and call the public API on behalf of the organization. Both endpoints require a valid session, API key or OAuth token and are scoped to the caller's own organization. There is no anonymous access and no cross-tenant exposure.","evidence":"cve:CVE-2026-107761","products":[{"name":{"value":"postiz-app","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-107761","aliases":["CVE-2026-107761"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N"}}],"affected":[{"repo":"https://github.com/gitroomhq/postiz-app","vendor":"GitroomHQ","product":"postiz-app","versions":[{"status":"affected","version":"0","lessThan":"2.25.1","versionType":"semver"}],"packageName":"postiz-app","defaultStatus":"unaffected"}],"modified":"2026-10-15T18:09:42.965Z","provider":"cve","references":["https://github.com/gitroomhq/postiz-app/commit/8ad0df3df0f21299b8640568358c1b68c6464e4f","https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.1","https://gadvisory.org/advisories/PSA-2026-4QX1WG"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-107761","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T17:51:22.688318Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T18:09:42.965Z"}}],"cna":{"orgId":"4cdc9741-f887-419a-a2fd-acbbd2729276","shortName":"postiz","dateUpdated":"2026-10-11T15:24:16.835Z"}}},"related_cves":[{"value":"CVE-2026-107761","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e395c738-fe10-4737-8380-995bd0f7b462","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107761","advisory_id":"e395c738-fe10-4737-8380-995bd0f7b462","event_types":["advisory"],"published_at":"2026-10-25T08:07:57.096831+00:00","technologies":["core-cve","postiz-app"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-11T15:23:15.196+00:00","detail_url":"/events/29962"},"members":[{"id":29962,"cve_ids":["CVE-2026-107761"],"payload":{"kind":"advisory","title":"Channel tokens and organization API key exposed in API responses","summary":"Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the caller is not meant to receive. The public API's channel delete returns the deleted integration row, including the channel's platform access token and refresh token. A third-party OAuth app permitted to delete a channel therefore receives that channel's social platform credentials and can use them against the connected account directly, outside Postiz. `GET /user/organizations` returns each organization row, including its API key, to every member of the organization. The API key is intended for admins only, so a member with a lower role can obtain it and call the public API on behalf of the organization. Both endpoints require a valid session, API key or OAuth token and are scoped to the caller's own organization. There is no anonymous access and no cross-tenant exposure.","evidence":"cve:CVE-2026-107761","products":[{"name":{"value":"postiz-app","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-107761","aliases":["CVE-2026-107761"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N"}}],"affected":[{"repo":"https://github.com/gitroomhq/postiz-app","vendor":"GitroomHQ","product":"postiz-app","versions":[{"status":"affected","version":"0","lessThan":"2.25.1","versionType":"semver"}],"packageName":"postiz-app","defaultStatus":"unaffected"}],"modified":"2026-10-15T18:09:42.965Z","provider":"cve","references":["https://github.com/gitroomhq/postiz-app/commit/8ad0df3df0f21299b8640568358c1b68c6464e4f","https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.1","https://gadvisory.org/advisories/PSA-2026-4QX1WG"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-107761","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T17:51:22.688318Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T18:09:42.965Z"}}],"cna":{"orgId":"4cdc9741-f887-419a-a2fd-acbbd2729276","shortName":"postiz","dateUpdated":"2026-10-11T15:24:16.835Z"}}},"related_cves":[{"value":"CVE-2026-107761","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e395c738-fe10-4737-8380-995bd0f7b462","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107761","advisory_id":"e395c738-fe10-4737-8380-995bd0f7b462","event_types":["advisory"],"published_at":"2026-10-25T08:07:57.096831+00:00","technologies":["core-cve","postiz-app"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-11T15:23:15.196+00:00","detail_url":"/events/29962"}]}}],"next_after":56302,"next_before":30206}