Stored XSS in Postiz public post preview page (CVE-2026-42556)

Authenticated users of Postiz can inject arbitrary HTML into post content by tampering save requests, then distribute the public preview link (/p/<postId>?share=true) to other users. The preview page renders the stored HTML via dangerouslySetInnerHTML on the main application origin, enabling persistent cross-site scripting attacks. Exploitation can result in privilege escalation to team admin, theft of API tokens, full API access under the victim's identity, and destruction of posts and integrations. Affected versions: - >= 2.21.6 We recommend updating to: >= 2.21.7. CVSS 9.0 · our assessment: act_now Reference: https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-hhxq-3wg7-4rj8 Details: https://vuln.today/cve/CVE-2026-42556