Postiz CVE-2026-94455

Exploitation requires the attacker to possess any valid login token issued by the target instance - i.e. an ordinary user account - because login tokens are signed with the same instance secret and carry no purpose, audience, or expiry claim, so they satisfy the endpoint's only check. The provisioning route is remotely reachable with no session because the enterprise controller is absent from the authentication middleware's controller allow-list. The practical limiting factor is that the attacker must be able to obtain a signed token; on instances that permit self-registration this is trivial, but a fully closed instance with no attacker-obtainable account would block the primary path. No user interaction and no non-default configuration are needed beyond a running Postiz instance prior to v2.24.0.

The CVSS 3.1 base score of 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) reflects a network-reachable, low-complexity flaw requiring only low privilege - consistent with CWE-306 (Missing Authentication for Critical Function): the provisioning controller is simply not on the authentication middleware's allow-list, and its only gate is a valid instance-secret signature that any ordinary login token satisfies. The 'PR:L' is well-chosen: the attacker does not need special rights, but does need a valid signed session token, i.e. any account on the instance. Confidentiality is scored N and availability L, with integrity H, which is defensible - the primary impact is unauthorized creation of a maximally-privileged 'lifetime' enterprise organisation and owner account (integrity), with resource/quota abuse (channel allowance 'far above any sold plan') driving the availability/cost impact rather than data disclosure. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation-probability signals are absent; based on the available signals this is a genuine business-logic/privilege-escalation defect worth prompt patching for anyone self-hosting Postiz, but there is no evidence of active or automated exploitation. The signals are internally consistent (network business-logic bug, low complexity, single-account precondition); the main missing data is any exploitation-likelihood telemetry.

An attacker registers or already holds an ordinary account on a Postiz instance, obtaining a normally-signed login token. They replay that token in the body of a request to the unauthenticated enterprise/reseller provisioning HTTP endpoint, which validates only the signature and not the token's purpose, and receive back the API key of a newly-created top-tier 'lifetime' organisation with an inflated channel allowance. No public exploit code was identified at time of analysis, but the attack is deterministic and requires no special tooling.