{"id":"CVE-2026-115933","kind":"vulnerability","aliases":["CVE-2026-115933"],"related":[],"title":"Postiz: user-supplied token claims let attackers forge sessions and resets","description":"Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token.\n\nA second, narrower route that creates team invitations signs extra fields from the request body in the same way.","summary":"Postiz signs sessions, invitations and password reset tokens with one shared secret and no purpose marker, and a channel-refresh route signs request-controlled data that users can read back. An attacker can obtain a validly signed token with chosen claims and use it as a session, an invitation with any role, or a password reset.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"postiz-app","fixed":["2.25.3"],"affected":">= 2.15.0, < 2.25.3","ecosystem":"github"}],"ecosystems":[],"tags":["account-takeover","auth-required","jwt","package","postiz","self-hosted"],"not_affected_if":["registration-disabled-and-no-untrusted-users","version-2.25.3-or-later","version-below-2.15.0"],"how_to_check":"Check your running Postiz version (image tag or postiz-app release): versions >= 2.15.0 and < 2.25.3 are affected. Instances that can reach api2.skool.com (default) are exposed; with Stripe billing, the attacker's plan must allow one channel and the target org must not be on STANDARD tier (session and password-reset tokens are not limited by this). Check whether DISABLE_REGISTRATION is true.","fix":"Upgrade postiz-app to 2.25.3 (also fixes sibling CVE-2026-115932). Since forged tokens are signed with the shared JWT secret and do not expire, consider rotating JWT_SECRET after upgrading, which invalidates all existing sessions (this rotation is my suggestion, not in the advisory). Interim: block POST /integrations/extension-refresh at the reverse proxy if you do not use browser-extension channels (the team invitation route stays open), and set DISABLE_REGISTRATION=true to limit who can attack.","status":"open","published_at":"2026-10-24T15:17:33+00:00","first_seen_at":"2026-10-24T16:18:39+00:00","triaged_at":"2026-10-25T02:59:35+00:00","updated_at":"2026-10-25T03:14:00+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-25T02:59:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Postiz: user-supplied token claims let attackers forge sessions and resets","impact":"high","summary":"Postiz signs sessions, invitations and password reset tokens with one shared secret and no purpose marker, and a channel-refresh route signs request-controlled data that users can read back. An attacker can obtain a validly signed token with chosen claims and use it as a session, an invitation with any role, or a password reset.","category":"package","nicknames":[],"who_cares":["postiz","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker forges tokens to take over accounts or organizations","analyst_note":"Find the affected Postiz versions, the patched release and the vendor advisory at the NVD entry; confirm whether the browser-extension refresh route needs an account.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Self-hosted or managed Postiz deployments that run the affected code path; the sources do not list affected versions or whether the browser-extension channel route is reachable by ordinary users. Teams that do not run Postiz can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00056,"input_tokens":3392,"output_tokens":441,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected Postiz versions, the patched release and the vendor advisory at the NVD entry; confirm whether the browser-extension refresh route needs an account.","search":"'-115933':15A,18A '-2026':14A,17A 'accept':163C 'account':23B 'account-takeov':22B 'app':21A 'applic':162C 'attack':8A,67B 'auth':26B 'auth-requir':25B 'back':65B,145C 'bodi':199C 'browser':124C 'browser-extens':123C 'channel':53B,126C 'channel-refresh':52B 'choos':159C 'chosen':75B,173C 'claim':6A,76B,157C 'contain':155C 'control':59B 'could':148C 'creat':190C 'credenti':120C 'cve':13A,16A 'data':60B,128C 'enterpris':182C 'extens':125C 'extra':194C 'field':195C 'forg':9A 'host':33B 'invit':37B,84B,96C,170C,192C 'jwt':28B 'let':7A 'marker':49B,108C 'narrow':187C 'obtain':69B,150C 'one':43B,102C 'organ':169C 'packag':29B 'password':39B,90B,98C,177C 'postiz':1A,20A,30B,34B,92C 'postiz-app':19A 'provis':183C 'purpos':48B 'read':64B,143C 'refresh':54B,118C 'request':58B,132C,140C,198C 'request-control':57B 'requir':27B 'reset':12A,40B,91B,99C,178C 'result':137C 'role':87B,174C 'rout':55B,116C,188C 'second':186C 'secret':45B,104C 'self':32B 'self-host':31B 'session':10A,36B,82B,95C,166C 'share':44B,103C 'sign':35B,56B,72B,93C,127C,153C,193C 'store':135C 'suppli':4A 'taken':129C 'takeov':24B 'team':191C 'therefor':149C 'token':5A,41B,73B,100C,112C,154C,184C 'use':78B 'user':3A,62B,141C,147C 'user-suppli':2A 'valid':71B,152C 'way':203C 'without':106C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed Postiz deployments that run the affected code path; the sources do not list affected versions or whether the browser-extension channel route is reachable by ordinary users. Teams that do not run Postiz can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-25T03:14:00Z","by":"analyst","run_id":676},"products":{"at":"2026-10-25T03:14:00Z","by":"analyst","run_id":676},"workarounds":{"at":"2026-10-25T03:14:00Z","by":"analyst","run_id":676},"who_affected":{"at":"2026-10-25T03:14:00Z","by":"analyst","run_id":676}},"analyst_revisit_at":null,"first_public_at":"2026-10-24T15:17:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"4cdc9741-f887-419a-a2fd-acbbd2729276","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115933","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115933","severity":null,"published_at":"2026-10-24T15:17:33+00:00","modified_at":"2026-10-24T15:17:33+00:00","first_seen_at":"2026-10-24T16:18:39+00:00","fetched_at":"2026-10-24T16:18:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115933:676","url":null,"severity":null,"published_at":"2026-10-25T03:14:00+00:00","modified_at":"2026-10-25T03:14:00+00:00","first_seen_at":"2026-10-25T03:14:00+00:00","fetched_at":"2026-10-25T03:14:00+00:00","note":"Read vendor advisory PSA-2026-YT2HMH: affected >=2.15.0 <2.25.3, fixed 2.25.3; needs a registered (ordinary) account, self-registration open by default; vendor PoC demonstrated by Anthropic, no reported in-the-wild exploitation. No social search done."}],"documents":[{"id":3070,"url":"https://postiz.gadvisory.org/advisories/PSA-2026-YT2HMH","title":"PSA-2026-YT2HMH: Forged signed tokens let any registered user take over other users and organizations","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3072,"url":"https://pwn.watch/i/postiz-account-takeover-file-read-cve-2026-115933","title":"pwn.watch: Postiz forged tokens and path traversal","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}