Postiz EUVD-2026-97100

Exploitation requires an authenticated principal - a valid Postiz session, API key, or OAuth token - that is already a member of the target organization; there is no anonymous access and no cross-tenant reach. To steal social-platform access/refresh tokens, the caller (for example a third-party OAuth app) must specifically hold permission to delete a channel via the public API. To obtain the admin-only organization API key, no elevated role is needed at all: ANY organization member, regardless of role, can call GET /user/organizations and receive the key in the returned org row. Limiting factors: both paths demand prior valid authentication and org membership, the exposure is confined to the caller's own organization, and the flaw is fixed in v2.25.1, so patched or single-tenant/trusted-member deployments are not realistically at risk.

This is a genuine but moderate-severity information-disclosure flaw, not a top-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 Medium score are internally consistent with the description: exploitation is remote and low-complexity but requires authenticated, low-privilege access (PR:L) scoped to the attacker's own organization - there is explicitly no anonymous and no cross-tenant exposure, which meaningfully caps blast radius. No EPSS score, KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the issue was reported by the vendor (Postiz) itself, which argues for responsible disclosure rather than in-the-wild abuse. The one factor that elevates real-world concern beyond the raw score is the NATURE of the leaked data: the channel-delete endpoint returns live social-platform access and refresh tokens, and GET /user/organizations returns the org API key to any member. These are reusable credentials that grant impact OUTSIDE Postiz (direct control of connected social accounts and privileged API calls on behalf of the org), which is why the vector carries subsequent-system impact (SC:L/SI:L) - the vendor's own confidentiality rating (VC:L) is arguably conservative given full token exposure. Net: real and worth patching promptly, but gated behind valid authentication and specific role/permission, so it is a privilege-escalation/credential-leak concern for multi-tenant or OAuth-app deployments rather than a mass-exploitable internet-facing critical.

A member of a Postiz organization holding only a low-privilege role (or a third-party OAuth app granted channel-delete permission) calls GET /user/organizations or the public API channel-delete endpoint and receives back the full database row - including the organization's admin-only API key and the channel's social-platform access and refresh tokens. The attacker then replays those tokens directly against the connected social account and the public API, acting with privileges they were never granted. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) means no special timing or conditions are needed once authenticated.