Postiz CVE-2026-48781

Exploitation requires (1) an authenticated session on the target Postiz instance - any low-privileged user account, including freshly self-registered ones where registration is open - and (2) network reachability to the Skool integration callback under the no-auth integrations controller. The attacker must base64-encode a JSON object shaped like the User session model (notably containing an id and isSuperAdmin: true) and submit it in the code field of the callback request; no Skool OAuth flow needs to be completed legitimately. There is no required user interaction from the victim, no platform-specific dependency, and no need for the Skool integration to be configured by the operator - the callback route is reachable in default deployments of any postiz-app build prior to 2.21.8.

All available signals converge on a high priority. The NVD CVSS 3.1 score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) accurately reflects that any low-privileged authenticated user - which on most Postiz instances means any self-registered account - can pivot to full SUPERADMIN with no user interaction and a scope change across all organizations on the instance. EPSS and CISA KEV data were not provided in the input, so widespread exploitation cannot be confirmed; however, the patch commit (23696d2) is public and clearly highlights the vulnerable two-line construct, making weaponization straightforward for anyone reading the diff. There is no conflict between the description and the CVSS vector: PR:L is appropriate because an attacker must hold a normal authenticated session to invoke the Skool callback, and S:C is justified because the forged session crosses organizational boundaries. The main caveat is that real-world impact depends on whether the Postiz instance is internet-exposed and accepts self-service registration; closed, single-tenant deployments still face an insider-threat path but the population of capable attackers is smaller.

An attacker registers a normal account on a target Postiz instance, then issues a request to the Skool integration callback with a base64-encoded JSON body specifying id of a target admin user and isSuperAdmin: true. The server signs that payload into a valid session JWT using JWT_SECRET, the attacker replaces their session cookie/header with it, and the auth middleware accepts the forged identity, granting full access to every organization and the ability to post under any connected social channel. No special tooling is required - a single curl invocation against the callback endpoint is sufficient, and the patch diff itself reveals the exact vulnerable parameter.