What is the CVSS score of CVE-2026-48781?

CVE-2026-48781 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Postiz are affected by CVE-2026-48781?

Postiz versions prior to 2.21.8 allow any authenticated user to escalate privileges to SUPERADMIN and impersonate arbitrary organizations through forged session tokens in the Skool integration.. A patch is available.

How to fix or mitigate CVE-2026-48781?

Within 24 hours: Inventory all Postiz deployments and identify versions; disable Skool integration if running versions prior to 2.21.8 until patched. Within 7 days: upgrade all instances to Postiz 2.21.8 or later and re-enable Skool integration. Within 30 days: review audit logs for unauthorized privilege escalation or cross-organization access during the vulnerability window; rotate JWT secrets and session tokens.

Postiz CVE-2026-48781

EUVD-2026-37505 CRITICAL

Authentication Bypass by Assumed-Immutable Data (CWE-302)

2026-06-16 GitHub_M

Information Disclosure Postiz App Gitroomhq

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable callback (AV:N), trivial forgery from patch diff (AC:L), any authenticated user suffices (PR:L), no victim interaction (UI:N); forged SUPERADMIN crosses org boundaries (S:C) with full CIA impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 16, 2026 - 23:27 vuln.today

Analysis Generated

Jun 16, 2026 - 23:27 vuln.today

Patch available

Jun 16, 2026 - 23:02 EUVD

DescriptionCVE.org

Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, the Skool integration callback signed an attacker-controlled JSON blob into a session-shape JWT using the application's JWT_SECRET, and the auth middleware trusted every claim in that JWT without re-resolving the user from the database. Any authenticated Postiz user could forge a SUPERADMIN session and impersonate arbitrary organizations. This allowed Full Access to the following: all parts of Postiz, including users registered to the specific instance and the ability to post in the name of the victim's social media channels added to that Postiz instance. This issue has been fixed in version 2.21.8.

AnalysisAI

Privilege escalation to SUPERADMIN in Postiz (gitroomhq/postiz-app) versions prior to 2.21.8 allows any authenticated user to forge session JWTs and impersonate arbitrary organizations. The Skool integration callback signed an attacker-controlled JSON blob into a session-shape JWT using the application's JWT_SECRET, and the auth middleware blindly trusted every claim without re-resolving the user from the database. No public exploit identified at time of analysis, but the fix commit is public and the root cause is trivially reproducible from the patch diff.

Technical ContextAI

Postiz is an open-source AI social media scheduling platform built on NestJS (gitroomhq/postiz-app) that uses signed JWTs to maintain user sessions across its backend API. The vulnerable code path is in apps/backend/src/api/routes/no.auth.integrations.controller.ts, where the Skool integration callback took a base64-encoded body.code field, JSON-parsed it, and passed the resulting object directly into AuthService.signJWT - effectively letting the caller dictate the JWT payload. Compounding this, AuthMiddleware (apps/backend/src/services/auth/auth.middleware.ts) only verified the JWT signature and then trusted the embedded id, isSuperAdmin, and activated claims wholesale instead of loading the user record from the database. This pattern maps to CWE-302 (Authentication Bypass by Assumed-Immutable Data): the server treats client-supplied, signature-protected fields as authoritative identity assertions.

RemediationAI

The primary fix is to upgrade to Vendor-released patch: Postiz 2.21.8 or later, available at http://github.com/gitroomhq/postiz-app/releases/tag/v2.21.8, which both replaces the dangerous AuthService.signJWT(JSON.parse(...)) call in the Skool callback with AuthService.fixedEncryption and forces AuthMiddleware to re-resolve the user from the database via _userService.getUserById(payload.id) instead of trusting JWT claims (commit 23696d2973510ae1f3f48bfa41a6bfbbf9827b05). If immediate upgrade is impossible, operators should block the Skool integration callback route at the reverse proxy or WAF layer to neutralize the JWT-minting primitive (trade-off: Skool integration stops working for legitimate users), restrict instance registration to invited users only to shrink the attacker population, and rotate JWT_SECRET after upgrading to invalidate any forged tokens that may already be in circulation (trade-off: forces all users to re-authenticate). Reviewing audit logs for unexpected SUPERADMIN actions and unfamiliar social posts attributed to legitimate accounts is recommended before patching, since the exploit leaves few obvious traces beyond the org switch itself.