Vulnerability · Published Oct 24, 2026 · Assigned by postiz
CVE-2026-115933Forged signed tokens let any registered user take over other users and organizations
Critical 9.9
In plain English
A critical-severity authentication bypass by spoofing in postiz-app from GitroomHQ. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Official description
Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token. A second, narrower route that creates team invitations signs extra fields from the request body in the same way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| GitroomHQ | postiz-app | 2.15.0 – before 2.25.3 |
Weakness: CWE-290, CWE-345, CWE-915 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H