Postiz CVE-2026-115933

Requires an authenticated low-privileged account on the target Postiz instance (PR:L) - exposure is amplified wherever self-registration is enabled. The primary exploitation path is the browser-extension channel credential-refresh route, which signs attacker-supplied data from the request with the shared token-signing secret and stores the signed result where the requesting user can read it back, yielding a validly signed token containing arbitrary claims; because tokens carry no marker of their intended purpose, that token is accepted interchangeably as a session, an organization invitation with a chosen role, a password reset, or an enterprise provisioning token. A second, narrower path is the team-invitation creation route, which signs extra fields taken from the request body in the same way. No non-default configuration is stated as required, and there is no user-interaction requirement; the limiting factor is possession of a valid (even minimal) account. The only complete fix stated by the vendor is upgrading to v2.25.3.

This is a genuine high-priority issue, not an inflated-CVSS artifact. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) is well-matched to the described flaw: a design-level authentication bypass (CWE-290) where tokens are signed with one shared secret and carry no type marker, letting an authenticated low-privileged user mint a validly signed token with arbitrary claims that the app honors as a session, an organization invitation with an attacker-chosen role, a password reset, or an enterprise provisioning token. The vuln.today Decision label is act_now and the vendor release notes direct all users to upgrade immediately, which aligns with the critical score. However, several exploitation-telemetry signals are MISSING from the input: no EPSS probability is provided, there is no CISA KEV listing (KEV=NO), and no PoC/exploit reference is present - so exploitation status is 'no public exploit identified at time of analysis'. The absence of EPSS/KEV is consistent with a freshly disclosed, vendor-reported issue rather than evidence of low risk; because the described attack is trivial once a user account exists (no special configuration, no race, no user interaction), the realistic risk is high despite the lack of active-exploitation data. One qualifier: exploitation requires an authenticated account (PR:L), so fully anonymous internet-wide compromise is not implied by the vector - this limits, but does not remove, exposure for instances allowing self-registration.

An attacker with a low-privileged account on a Postiz instance calls the browser-extension channel credential-refresh route, supplying the claims they want; the route signs that attacker-controlled data with the shared secret and stores the signed token where the requesting user can read it back. The attacker retrieves the validly signed token and replays it as an administrative session, or self-issues an organization invitation with an owner/admin role (or a password-reset / enterprise-provisioning token), achieving full account and organization takeover. No public exploit code is identified at time of analysis, but the described mechanism requires no special tooling.