Live › vulnerability › CVE-2026-115933
Go to dashboardPostiz signs sessions, invitations and password reset tokens with one shared secret and no purpose marker, and a channel-refresh route signs request-controlled data that users can read back. An attacker can obtain a validly signed token with chosen claims and use it as a session, an invitation with any role, or a password reset.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 16:18 UTC. All times on this page are UTC.
Self-hosted or managed Postiz deployments that run the affected code path; the sources do not list affected versions or whether the browser-extension channel route is reachable by ordinary users. Teams that do not run Postiz can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| postiz-app | github | >= 2.15.0, < 2.25.3 | 2.25.3 |
2.15.0 and < 2.25.3 are affected2.25.3 (also fixes sibling CVE-2026-115932)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token.
A second, narrower route that creates team invitations signs extra fields from the request body in the same way.
This page as .md · .json · in your agent: get_signal("CVE-2026-115933")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.