What is the CVSS score of CVE-2026-42556?

CVE-2026-42556 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Postiz are affected by CVE-2026-42556?

Postiz 2.21.6 allows any authenticated user to inject malicious code into posts that executes in other users' authenticated sessions when preview links are shared, enabling potential account…

How to fix or mitigate CVE-2026-42556?

Within 24 hours, audit all Postiz deployments to identify systems running version 2.21.6 and restrict public preview link sharing until patching is complete if operationally feasible. Within 7 days, upgrade all affected Postiz instances to version 2.21.7 or later to apply the vendor patch. Within 30 days, review access logs and post creation audit trails from the vulnerable version to identify any suspicious post creation or preview link sharing activity; if misuse is identified, conduct security awareness training on this attack vector.

Postiz CVE-2026-42556

CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-05-08 GitHub_M

XSS Postiz App Gitroomhq

9.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.7 HIGH

Authenticated user can inject (PR:L) but needs victim to open the shared link (UI:R); same-origin script execution changes scope (S:C) yielding high C/I, with no real availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Jul 24, 2026 - 21:22 vuln.today

cvss_changed

Severity Changed

Jul 24, 2026 - 21:22 NVD

HIGH CRITICAL

CVSS changed

Jul 24, 2026 - 21:22 NVD

8.9 (HIGH) 9.0 (CRITICAL)

Source Code Evidence Fetched

Jul 24, 2026 - 00:24 vuln.today

Analysis Generated

Jul 24, 2026 - 00:24 vuln.today

CVE Published

May 08, 2026 - 22:28 nvd

HIGH 8.9

DescriptionNVD

Postiz is an AI social media scheduling tool. From version 2.21.6 to before version 2.21.7, any authenticated user who can create a post can store arbitrary HTML in post content by tampering their own save request and send the public preview link /p/<postId>?share=true to another user. The preview page renders that stored HTML with dangerouslySetInnerHTML on the main application origin. This issue has been patched in version 2.21.7.

AnalysisAI

Stored cross-site scripting in Postiz (gitroomhq/postiz-app) versions 2.21.6 through 2.21.6 lets any authenticated user who can create a post inject arbitrary HTML into post content by tampering with their own save request, then weaponize it via the public preview link /p/<postId>?share=true. Because the preview page renders the stored markup with dangerouslySetInnerHTML on the main application origin, a shared link executes attacker JavaScript in a victim's authenticated session context. There is no public exploit identified at time of analysis and EPSS is very low (0.04%), but SSVC rates the technical impact as total; the issue is fixed in 2.21.7.

Technical ContextAI

Postiz is a self-hostable AI-driven social-media scheduling platform (Node/React). The flaw is a classic CWE-79 stored XSS: user-controlled post content is persisted without sanitization and later injected into the DOM through React's dangerouslySetInnerHTML, which deliberately bypasses React's default HTML escaping. The critical amplifier is that the vulnerable render occurs on the /p/<postId> public preview route served from the main application origin rather than a sandboxed domain, so injected script runs with the same-origin privileges of the Postiz app (cookies, localStorage tokens, in-app API access). The affected package is identified in CPE as cpe:2.3:a:gitroomhq:postiz-app.

RemediationAI

Vendor-released patch: upgrade to Postiz 2.21.7, which the vendor flags as an immediate-upgrade security release (https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.7 and advisory GHSA-hhxq-3wg7-4rj8). If you cannot upgrade immediately, apply compensating controls: restrict or disable the public preview feature (the /p/<postId>?share=true share route) so stored content cannot be rendered to other users - trade-off is loss of shareable previews; front the app with a WAF or reverse-proxy rule that strips/escapes HTML in post-save requests and blocks script-bearing preview responses - trade-off is possible false positives on legitimate rich content; and tighten account provisioning so only trusted users can create posts, since exploitation requires an authenticated post-creating account. Adding a strict Content-Security-Policy (disallowing inline script on the app origin) reduces impact of any injected markup, though it may break existing inline UI behavior and is a defense-in-depth measure, not a full fix.