---
id: "CVE-2026-115933"
kind: "vulnerability"
aliases: ["CVE-2026-115933"]
title: "Postiz: user-supplied token claims let attackers forge sessions and resets"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "postiz-app", "fixed": ["2.25.3"], "affected": ">= 2.15.0, < 2.25.3", "ecosystem": "github"}]
ecosystems: []
tags: ["account-takeover", "auth-required", "jwt", "package", "postiz", "self-hosted"]
not_affected_if: ["registration-disabled-and-no-untrusted-users", "version-2.25.3-or-later", "version-below-2.15.0"]
published_at: "2026-10-24T15:17:33+00:00"
first_seen_at: "2026-10-24T16:18:39+00:00"
updated_at: "2026-10-25T03:14:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115933", "first_seen_at": "2026-10-24T16:18:39+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:14:00+00:00"}]
---

# Postiz: user-supplied token claims let attackers forge sessions and resets

Postiz signs sessions, invitations and password reset tokens with one shared secret and no purpose marker, and a channel-refresh route signs request-controlled data that users can read back. An attacker can obtain a validly signed token with chosen claims and use it as a session, an invitation with any role, or a password reset.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:postiz-app affected >= 2.15.0, < 2.25.3 fixed 2.25.3

## How to check

Check your running Postiz version (image tag or postiz-app release): versions >= 2.15.0 and < 2.25.3 are affected. Instances that can reach api2.skool.com (default) are exposed; with Stripe billing, the attacker's plan must allow one channel and the target org must not be on STANDARD tier (session and password-reset tokens are not limited by this). Check whether DISABLE_REGISTRATION is true.

## Fix

Upgrade postiz-app to 2.25.3 (also fixes sibling CVE-2026-115932). Since forged tokens are signed with the shared JWT secret and do not expire, consider rotating JWT_SECRET after upgrading, which invalidates all existing sessions (this rotation is my suggestion, not in the advisory). Interim: block POST /integrations/extension-refresh at the reverse proxy if you do not use browser-extension channels (the team invitation route stays open), and set DISABLE_REGISTRATION=true to limit who can attack.

## Timeline

- 2026-10-24T16:18:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115933
- 2026-10-25T03:14:00+00:00 analyst — Read vendor advisory PSA-2026-YT2HMH: affected >=2.15.0 <2.25.3, fixed 2.25.3; needs a registered (ordinary) account, self-registration open by default; vendor PoC demonstrated by Anthropic, no reported in-the-wild exploitation. No social search done.

## Documents

- [advisory] PSA-2026-YT2HMH: Forged signed tokens let any registered user take over other users and organizations https://postiz.gadvisory.org/advisories/PSA-2026-YT2HMH
- [mentions] pwn.watch: Postiz forged tokens and path traversal https://pwn.watch/i/postiz-account-takeover-file-read-cve-2026-115933

## From the sources

Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token.

A second, narrower route that creates team invitations signs extra fields from the request body in the same way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_