GitroomHQ postiz-app

• CVE-2026-115933 Critical 9.9 Forged signed tokens let any registered user take over other users and organizations 0.2%
• CVE-2026-115932 Critical 9.6 Path traversal in post media lets any registered user read server files 0.4%
• CVE-2026-115931 Critical 9.9 Arbitrary file read and backend crash through unrestricted provider method calls 0.5%
• CVE-2026-107761 Medium 5.3 Channel tokens and organization API key exposed in API responses 0.3%
• CVE-2026-94455 High 7.1 Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key 0.3%
• CVE-2026-94456 Critical 9.1 Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys 0.5%
• CVE-2026-19264 Critical 9.8 Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover 1.0%
• CVE-2026-19127 Medium 6.5 Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions 0.3%
• CVE-2026-48799 High 7.7 Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook 0.2%
• CVE-2026-48783 Medium 4.8 Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription 0.2%
• CVE-2026-48781 Critical 9.9 Postiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgery 0.2%
• CVE-2026-42556 High 8.9 Postiz stored XSS in public preview page 0.3%
• CVE-2026-42346 Medium 6.5 Postiz: TOCTOU DNS rebinding bypasses all SSRF URL validation paths 0.2%
• CVE-2026-42298 Critical 10.0 Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev 0.5%
• CVE-2026-40487 High 8.9 Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS 0.2%
• CVE-2026-40168 High 8.2 Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream 0.4%
• CVE-2026-34590 Medium 5.4 Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation 0.2%
• CVE-2026-34577 High 8.6 Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check 0.5%
• CVE-2026-34576 High 8.3 Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata 0.3%
• CVE-2025-53641 High 8.2 Postiz allows header mutation in middleware facilitates resulting in SSRF 0.3%