Forged signed tokens let any registered user take over other users and organizations
Summary
| CVE | CVE-2026-115933 |
|---|---|
| State | PUBLISHED |
| Assigner | postiz |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-24 15:17:33 UTC |
| Updated | 2026-10-24 15:17:33 UTC |
| Description | Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token. A second, narrower route that creates team invitations signs extra fields from the request body in the same way. |
Risk And Classification
Primary CVSS: v3.1 9.9 CRITICAL from 4cdc9741-f887-419a-a2fd-acbbd2729276
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Problem Types: CWE-290 | CWE-345 | CWE-915 | CWE-290 CWE-290 | CWE-345 CWE-345 | CWE-915 CWE-915
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | 4cdc9741-f887-419a-a2fd-acbbd2729276 | Secondary | 9.9 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 9.9 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | GitroomHQ | Postiz-app | affected 2.15.0 2.25.3 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/gitroomhq/postiz-app | 4cdc9741-f887-419a-a2fd-acbbd2729276 | github.com | |
| github.com/gitroomhq/postiz-app/releases/tag/v2.25.3 | 4cdc9741-f887-419a-a2fd-acbbd2729276 | github.com | |
| gadvisory.org/advisories/PSA-2026-YT2HMH | 4cdc9741-f887-419a-a2fd-acbbd2729276 | gadvisory.org | |
| github.com/gitroomhq/postiz-app/commit/a5affe62c74e39c1e7ac960d50d8418b8... | 4cdc9741-f887-419a-a2fd-acbbd2729276 | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Anthropic, PBC (en)
CNA: Enno Gelhaus (en)
CNA: Nevo David (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-10-23T17:45:00.000Z | Anthropic has disclosed a thorough report of this vulnerability including a working PoC to Postiz |
| CNA | 2026-10-23T18:00:00.000Z | Postiz has reproduced the vulnerability and is working on a fix |
| CNA | 2026-10-24T13:27:00.000Z | Postiz has pushed a fix for this vulnerability and verified it |
| CNA | 2026-10-24T14:18:00.000Z | Postiz has created a release and published the advisory |
Workarounds
CNA: If you do not use channels that rely on the Postiz browser extension, block POST /integrations/extension-refresh at your reverse proxy. This removes the main signing route; the team invitation route remains.
CNA: Set DISABLE_REGISTRATION=true. The attacker needs an ordinary account, so closing self-registration limits exposure to people who already hold one. This reduces reach, it does not close the issue.
Exploits
CNA: Exploitation was demonstrated end to end against an unmodified backend build at commit 3a7d28b7ad96: a second self-registered user became super administrator of another user's organization and read its API key. Session, password reset, enterprise and subscription tokens obtained the same way were each accepted by their endpoints.