Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key
Summary
| CVE | CVE-2026-94455 |
|---|---|
| State | PUBLISHED |
| Assigner | postiz |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-22 17:17:31 UTC |
| Updated | 2026-09-22 19:37:36 UTC |
| Description | An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The endpoint's only check is that the request body carries a token bearing a valid signature from the instance secret. It does not check what that token was issued for. Login tokens are signed with the same secret and carry no purpose, audience or expiry claim, so an ordinary user's own session token satisfies the check. Presented with such a token, the endpoint creates a new organisation holding the highest subscription tier, flagged as lifetime and with a channel allowance far above any sold plan, creates an organisation-owner account alongside it, and returns the new organisation's API key in the response body. That key is immediately valid against the public API. |
Risk And Classification
Primary CVSS: v3.1 7.1 HIGH from 4cdc9741-f887-419a-a2fd-acbbd2729276
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Problem Types: CWE-306 | CWE-345 | CWE-770 | CWE-1390 | CWE-306 CWE-306 | CWE-1390 CWE-1390 | CWE-345 CWE-345 | CWE-770 CWE-770
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | 4cdc9741-f887-419a-a2fd-acbbd2729276 | Secondary | 7.1 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L |
| 3.1 | CNA | CVSS | 7.1 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | GitroomHQ | Postiz-app | affected 2.4.0 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/gitroomhq/postiz-app | 4cdc9741-f887-419a-a2fd-acbbd2729276 | github.com | |
| github.com/gitroomhq/postiz-app/releases/tag/v2.24.0 | 4cdc9741-f887-419a-a2fd-acbbd2729276 | github.com | |
| github.com/gitroomhq/postiz-app/commit/9259cf2429e8cc0c88414e88d5e6c783d... | 4cdc9741-f887-419a-a2fd-acbbd2729276 | github.com | |
| gadvisory.org/advisories/PSA-2026-P8W1J0 | 4cdc9741-f887-419a-a2fd-acbbd2729276 | gadvisory.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Santosh Kumar Puppala (en)
CNA: Enno Gelhaus (en)
CNA: Nevo David (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-09-21T13:34:00.000Z | Postiz has received and acknowledged the report. |
| CNA | 2026-09-21T20:15:00.000Z | Postiz has verified the report. |
| CNA | 2026-09-22T04:32:00.000Z | Postiz has developed and verified the patch. |
| CNA | 2026-09-22T14:17:00.000Z | Postiz has released the patch notes and published the advisory. |
Workarounds
CNA: Block POST /enterprise/create-user, and preferably all of /enterprise/*, at your reverse proxy, ingress or WAF. If you do not use Postiz's enterprise or reseller provisioning integration, nothing legitimate calls these routes, so blocking them has no user-visible effect.
CNA: Set DISABLE_REGISTRATION=true. The caller needs an ordinary account on your instance to obtain a usable token, so closing self-registration limits exposure to people who already have one. This reduces reach, it does not close the issue.
Exploits
CNA: 1. Register an ordinary account on the target instance and capture that account's own login JWT.
CNA: 2. POST /api/enterprise/create-user with body {"params": "<that login JWT, verbatim>"}.
CNA: 3. The response is 200 with {"id": "<new organisation id>", "apiKey": "<key>"}.
CNA: 4. Confirm the new organisation carries subscriptionTier=ULTIMATE, isLifetime=true and totalChannels=1000000, and that it is distinct from the caller's own registration organisation.
CNA: 5. Send the returned apiKey as the Authorization header against a public API endpoint and confirm 200, versus 401 for an invalid key.
CNA: Controls: an absent token, a malformed token, and a token with a valid-looking payload but a wrong signature all fail with no organisation created, confirming signature verification is the only gate.