CVE-2026-115933
Forged signed tokens let any registered user take over other users and organizations
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack conditions and impact
Derived from the CNA (via NVD) CVSS 3.1 vector| Metric | Value | Meaning |
|---|---|---|
| Attack vector AV | N | Network |
| Attack complexity AC | L | Low (easy) |
| Privileges required PR | L | Regular user |
| User interaction UI | N | None |
| Scope S | C | Changed (affects other components) |
| Confidentiality C | H | High |
| Integrity I | H | High |
| Availability A | H | High |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Description
Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token. A second, narrower route that creates team invitations signs extra fields from the request body in the same way.
Workarounds (CNA)
If you do not use channels that rely on the Postiz browser extension, block POST /integrations/extension-refresh at your reverse proxy. This removes the main signing route; the team invitation route remains.
Set DISABLE_REGISTRATION=true. The attacker needs an ordinary account, so closing self-registration limits exposure to people who already hold one. This reduces reach, it does not close the issue.
CVSS assessments
| Provider | Version | Score | Vector |
|---|---|---|---|
| NVD / 4cdc9741-f887-419a-a2fd-acbbd2729276 (Secondary) | 3.1 | 9.9 CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| CNA / postiz | 3.1 | 9.9 CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| GitroomHQ | postiz-app | affected: 2.15.0 … < 2.25.3 default: unaffected |
Linux distribution status
References (4)
- https://gadvisory.org/advisories/PSA-2026-YT2HMH NVD, CNA vendor-advisory
- https://github.com/gitroomhq/postiz-app NVD, CNA product
- https://github.com/gitroomhq/postiz-app/commit/a5affe62c74e39c1e7ac960d50d8418b807d532c NVD, CNA patch
- https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3 NVD, CNA release-notes