CVE-2026-115933 Details
Description
Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token. A second, narrower route that creates team invitations signs extra fields from the request body in the same way.
A vulnerability exists in Postiz version 2.15.0 through 2.25.2, allowing registered users to forge session, invitation, and password reset tokens. This is achieved by exploiting a route that refreshes browser-extension channel credentials, which inadvertently signs user-defined data with a shared secret. The absence of token purpose markers enables the creation of tokens that the application accepts as valid for various sensitive actions, such as logging in as another user, joining organizations as a super administrator, or resetting passwords.
Users are advised to upgrade to Postiz version 2.25.3, where this vulnerability has been fixed. Instructions for updating can be found in the Postiz release notes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 24, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gadvisory.org/advisories/PSA-2026-YT2HMH | postiz | AdvisoryExploitRemedy |
| https://github.com/gitroomhq/postiz-app | postiz | Source CodeVendor |
| https://github.com/gitroomhq/postiz-app/commit/a5affe62c74e39c1e7ac960d50d8418b807d532c | postiz | Source CodeVendor |
| https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3 | postiz | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-290 | Authentication Bypass by Spoofing | postiz |
| CWE-345 | Insufficient Verification of Data Authenticity | postiz |
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | postiz |
Affected Products
| Product | Versions |
|---|---|
| GitroomHQ Postiz | >= 2.15.0, < 2.25.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 24, 2026 | New CVE Received | postiz |