Postiz App
Monthly
Improper token-purpose validation in Postiz (gitroomhq/postiz-app) through v2.25.2 allows any authenticated user holding a low-privileged account to obtain a validly signed token containing claims of their choosing, which the application then accepts interchangeably as a session, an organization invitation carrying a chosen role, a password reset, or an enterprise provisioning token. The primary path is the browser-extension channel credential-refresh route, which signs attacker-supplied data taken from the request itself with the shared token-signing secret and stores the signed result where the requesting user can read it back; a second, narrower team-invitation creation route signs extra request-body fields in the same way. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, but the vendor rates the issue critical (CVSS 9.9, scope changed) and the priority label is act_now, with upgrading to v2.25.3 stated as the only complete fix.
Postiz instances older than v2.25.3 that store media on local disk let a registered user have the publishing worker read an arbitrary file from the server and send it as an attachment to a Discord server the user controls; because self-registration is open by default, the attacker effectively needs no pre-existing account, only network reach to the instance. The flaw is an unconfined path traversal (CWE-22) in the media readers: a media value that is not an HTTP(S) address is treated as a file on the worker's disk and opened without confirming it lies inside UPLOAD_DIRECTORY, and two further routes reach the same reads, one acting as a file-existence oracle that can also exhaust backend memory. Confidentiality impact is high, integrity is not affected, availability impact is at most limited, the vendor fix is v2.25.3, the issue is prioritised act_now, and no public exploit code was identified at time of analysis.
Postiz (gitroomhq/postiz-app) before v2.25.1 allows any signed-in user to invoke arbitrary internal integration methods through the POST /integrations/function endpoint, using a connected channel's token as the first argument. By setting that token to a filesystem path, an attacker can read server files such as the application environment, exposing the session-signing secret, database address and third-party service credentials; a separate internal helper can terminate the backend process with one request. Self-registration is open by default, so an external attacker can obtain the required low-privilege account without any action by another user, and no public exploit code has been identified at time of analysis.
Missing authentication on Postiz's enterprise/reseller organisation provisioning endpoint lets an authenticated low-privilege user escalate into full control of a newly minted top-tier organisation. Because the enterprise controller was omitted from the authentication middleware's allow-list, the route is network-reachable without any session, and its sole gate - a signature check on a token in the request body - is satisfied by the attacker's own ordinary login token, since login tokens are signed with the same instance secret and carry no purpose, audience or expiry claim. The endpoint then creates an organisation on the highest subscription tier flagged lifetime with an oversized channel allowance, provisions an owner account for the attacker, and returns a working API key for the public API in the response body (CVSS 3.1 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L; CWE-306). No public exploit code has been identified at time of analysis, but the attacker only needs any valid account on the instance, which on self-registration-enabled deployments means anyone. Vendor-released patch: v2.24.0.
Predictable, non-cryptographic credential generation in Postiz (gitroomhq/postiz-app, all versions prior to v2.24.0) allows unauthenticated remote attackers to reconstruct the V8 xorshift128+ PRNG state and derive OAuth access tokens, authorization codes, client secrets, organization API keys and PKCE verifiers issued to other users and organizations. Practical exploitation is limited by the requirement that the unauthenticated OAuth dynamic client registration endpoint be enabled and network-reachable, since that endpoint is what returns freshly generated client credentials supplying the consecutive PRNG output needed to solve for internal state; concurrent credential generation by other users interleaves draws and degrades recoverability, which is why the assessed vector carries high attack complexity. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but successful exploitation yields high confidentiality and integrity impact across tenants, and a vendor patch is available in v2.24.0 (advisory PSA-2026-TD98KY).
Arbitrary file read in Postiz (gitroomhq/postiz-app before 2.22.1) lets an unauthenticated remote attacker retrieve any file readable by the application process via the /api/uploads media route, which fails to confine URL-supplied path segments to the upload directory. Because URL-encoded traversal sequences survive Next.js route matching and are decoded only at the filesystem call, an attacker can read the process environment to steal the JWT signing secret, then forge a non-expiring administrator session without a password - turning a file-disclosure bug into full account takeover. There is publicly available fix code (vendor commit and v2.22.1 release), but no public exploit identified at time of analysis and the issue is not in CISA KEV.
Business-logic authentication bypass in Postiz self-hosted AI social media scheduler (gitroomhq/postiz-app) before 2.21.8 lets a low-privileged authenticated user grant any organization a lifetime PRO subscription without paying. The Nowpayments IPN (Instant Payment Notification) callback handler never validated the provider's shared-secret signature and trusted the subscription/organization identifier straight from the request body, so an attacker could forge a payment-confirmation callback. No public exploit identified at time of analysis and the issue is not in CISA KEV; it was privately reported and fixed by removing the crypto-payment code path entirely.
Privilege escalation to SUPERADMIN in Postiz (gitroomhq/postiz-app) versions prior to 2.21.8 allows any authenticated user to forge session JWTs and impersonate arbitrary organizations. The Skool integration callback signed an attacker-controlled JSON blob into a session-shape JWT using the application's JWT_SECRET, and the auth middleware blindly trusted every claim without re-resolving the user from the database. No public exploit identified at time of analysis, but the fix commit is public and the root cause is trivially reproducible from the patch diff.
Stored cross-site scripting in Postiz (gitroomhq/postiz-app) versions 2.21.6 through 2.21.6 lets any authenticated user who can create a post inject arbitrary HTML into post content by tampering with their own save request, then weaponize it via the public preview link /p/<postId>?share=true. Because the preview page renders the stored markup with dangerouslySetInnerHTML on the main application origin, a shared link executes attacker JavaScript in a victim's authenticated session context. There is no public exploit identified at time of analysis and EPSS is very low (0.04%), but SSVC rates the technical impact as total; the issue is fixed in 2.21.7.
Arbitrary code execution and privileged token theft affects Postiz (gitroomhq/postiz-app) prior to commit da44801 through an insecure GitHub Actions 'Pwn Request' pattern in the Build and Publish PR Docker Image workflow. Because the workflow triggers on pull_request_target with 'permissions: write-all' yet checks out and builds the untrusted fork head (Dockerfile.dev), any unauthenticated GitHub user can open a fork PR with a malicious Dockerfile.dev to run code on the runner and exfiltrate a write-all GITHUB_TOKEN, effectively hijacking the repository's CI/CD supply chain. Rated CVSS 10.0 with SSVC technical impact 'total' and automatable 'yes', but EPSS is low (0.14%) with no public exploit or KEV listing at time of analysis.
File upload validation bypass in Postiz social media scheduler (versions before 2.21.6) allows authenticated users to upload executable file types (HTML, SVG) with spoofed Content-Type headers, achieving stored XSS when nginx serves files using their original extensions. Attackers can hijack sessions and take over other user accounts. CVSS 8.9 (High) reflects network attack vector with low complexity requiring only low-privilege authentication and user interaction. EPSS data not provided. Not listed in CISA KEV. Vendor patch released in version 2.21.6.
Server-side request forgery in Postiz (gitroomhq postiz-app) versions prior to 2.21.5 allows unauthenticated remote attackers to access internal network resources and exfiltrate sensitive data via the /api/public/stream endpoint. The vulnerability exploits inadequate redirect validation: attackers supply public HTTPS URLs that pass initial validation but redirect server requests to private internal hosts, bypassing security controls. High confidentiality impact with potential service disruption. No public exploit identified at time of analysis.
Server-side request forgery in Postiz AI social media scheduling tool (versions < 2.21.3) allows unauthenticated remote attackers to read internal network resources and cloud metadata endpoints through the /public/stream proxy endpoint. The vulnerability bypasses trivial .mp4 validation via query parameters or URL fragments, enabling unauthorized access to internal services without authentication. No public exploit identified at time of analysis, but CVSS 8.6 reflects high confidentiality impact with network-level attack vector and low complexity. EPSS data not available, but the combination of no authentication requirement and cloud metadata access risk makes this a priority for organizations running Postiz in cloud environments.
Server-side request forgery (SSRF) in Postiz social media scheduling tool versions prior to 2.21.3 allows authenticated API users to fetch arbitrary URLs by exploiting the POST /public/v1/upload-from-url endpoint, which performs server-side URL fetching via axios without SSRF protections and relies solely on a bypassable file extension check. Attackers can retrieve internal network resources, cloud metadata, and internal service data, with responses captured and returned to the attacker. Vendor-released patch available in version 2.21.3.
Information disclosure in Postiz (gitroomhq/postiz-app) prior to v2.25.1 causes two API endpoints to return full database rows rather than the limited field sets clients require, exposing secrets to callers who should not receive them. The public API's channel-delete operation returns the deleted integration row including the channel's platform access and refresh tokens, so a third-party OAuth app holding delete permission can obtain social-platform credentials and act against the connected account outside Postiz, while GET /user/organizations returns each organization row - including the admin-only organization API key - to every member regardless of role, letting a low-privileged member call the public API on the organization's behalf. Exploitation requires a valid Postiz session, API key, or OAuth token already belonging to the target organization (authentication requirements: authenticated per the assessed vector CVSS:4.0/.../PR:L); there is no anonymous access and no cross-tenant exposure, no public exploit code was identified at time of analysis, and the flaw is fixed in v2.25.1, making this a genuine but moderate-severity disclosure rather than a top-priority emergency.
Unauthenticated exploitation of Postiz's `/public/modify-subscription` endpoint allowed any caller in possession of a validly signed NowPayments callback token to trigger subscription enforcement side effects against their own organization - disabling team members, dropping integrations, and resetting the scheduled-post cron - without Postiz authentication. The flaw (CWE-345) stems from the NowPayments crypto payment integration: the endpoint verified the token's cryptographic signature but never validated its intended purpose or bound it to a specific subscription-modification context. Impact is strictly self-contained; the endpoint cannot be redirected at other tenants. No public exploit code and no CISA KEV listing have been identified at time of analysis. The issue is fixed in Postiz 2.21.8.
DNS rebinding exploits a TOCTOU flaw in Postiz v2.16.6-2.21.6 to bypass all SSRF protections added in v2.21.4-v2.21.6, allowing unauthenticated remote attackers to reach internal network services and cloud metadata endpoints. The root defect is architectural: `isSafePublicHttpsUrl()` validates an IP via one DNS resolution, but the subsequent `fetch()` call performs its own independent DNS resolution - an attacker controlling a DNS server can return a legitimate public IP on the first query and swap to an internal address (e.g., 169.254.169.254) on the second. No public exploit has been identified and exploitation is not confirmed by CISA KEV, but the high confidentiality impact reflects realistic cloud-credential theft via IMDSv1-style metadata services.
Server-side request forgery (SSRF) in Postiz prior to version 2.21.4 allows authenticated users to create webhooks pointing to internal or private network addresses, which are then fetched without runtime validation when posts are published, enabling blind SSRF attacks against internal services. The vulnerability stems from inconsistent input validation: the webhook creation endpoint (POST /webhooks/) uses only basic URL format checking, while the update and test endpoints correctly enforce strict URL validation. CVSS 5.4 with EPSS exploitation probability reflects the requirement for authentication and limited direct impact, though the ability to target internal infrastructure represents meaningful risk.
Improper token-purpose validation in Postiz (gitroomhq/postiz-app) through v2.25.2 allows any authenticated user holding a low-privileged account to obtain a validly signed token containing claims of their choosing, which the application then accepts interchangeably as a session, an organization invitation carrying a chosen role, a password reset, or an enterprise provisioning token. The primary path is the browser-extension channel credential-refresh route, which signs attacker-supplied data taken from the request itself with the shared token-signing secret and stores the signed result where the requesting user can read it back; a second, narrower team-invitation creation route signs extra request-body fields in the same way. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, but the vendor rates the issue critical (CVSS 9.9, scope changed) and the priority label is act_now, with upgrading to v2.25.3 stated as the only complete fix.
Postiz instances older than v2.25.3 that store media on local disk let a registered user have the publishing worker read an arbitrary file from the server and send it as an attachment to a Discord server the user controls; because self-registration is open by default, the attacker effectively needs no pre-existing account, only network reach to the instance. The flaw is an unconfined path traversal (CWE-22) in the media readers: a media value that is not an HTTP(S) address is treated as a file on the worker's disk and opened without confirming it lies inside UPLOAD_DIRECTORY, and two further routes reach the same reads, one acting as a file-existence oracle that can also exhaust backend memory. Confidentiality impact is high, integrity is not affected, availability impact is at most limited, the vendor fix is v2.25.3, the issue is prioritised act_now, and no public exploit code was identified at time of analysis.
Postiz (gitroomhq/postiz-app) before v2.25.1 allows any signed-in user to invoke arbitrary internal integration methods through the POST /integrations/function endpoint, using a connected channel's token as the first argument. By setting that token to a filesystem path, an attacker can read server files such as the application environment, exposing the session-signing secret, database address and third-party service credentials; a separate internal helper can terminate the backend process with one request. Self-registration is open by default, so an external attacker can obtain the required low-privilege account without any action by another user, and no public exploit code has been identified at time of analysis.
Missing authentication on Postiz's enterprise/reseller organisation provisioning endpoint lets an authenticated low-privilege user escalate into full control of a newly minted top-tier organisation. Because the enterprise controller was omitted from the authentication middleware's allow-list, the route is network-reachable without any session, and its sole gate - a signature check on a token in the request body - is satisfied by the attacker's own ordinary login token, since login tokens are signed with the same instance secret and carry no purpose, audience or expiry claim. The endpoint then creates an organisation on the highest subscription tier flagged lifetime with an oversized channel allowance, provisions an owner account for the attacker, and returns a working API key for the public API in the response body (CVSS 3.1 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L; CWE-306). No public exploit code has been identified at time of analysis, but the attacker only needs any valid account on the instance, which on self-registration-enabled deployments means anyone. Vendor-released patch: v2.24.0.
Predictable, non-cryptographic credential generation in Postiz (gitroomhq/postiz-app, all versions prior to v2.24.0) allows unauthenticated remote attackers to reconstruct the V8 xorshift128+ PRNG state and derive OAuth access tokens, authorization codes, client secrets, organization API keys and PKCE verifiers issued to other users and organizations. Practical exploitation is limited by the requirement that the unauthenticated OAuth dynamic client registration endpoint be enabled and network-reachable, since that endpoint is what returns freshly generated client credentials supplying the consecutive PRNG output needed to solve for internal state; concurrent credential generation by other users interleaves draws and degrades recoverability, which is why the assessed vector carries high attack complexity. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but successful exploitation yields high confidentiality and integrity impact across tenants, and a vendor patch is available in v2.24.0 (advisory PSA-2026-TD98KY).
Arbitrary file read in Postiz (gitroomhq/postiz-app before 2.22.1) lets an unauthenticated remote attacker retrieve any file readable by the application process via the /api/uploads media route, which fails to confine URL-supplied path segments to the upload directory. Because URL-encoded traversal sequences survive Next.js route matching and are decoded only at the filesystem call, an attacker can read the process environment to steal the JWT signing secret, then forge a non-expiring administrator session without a password - turning a file-disclosure bug into full account takeover. There is publicly available fix code (vendor commit and v2.22.1 release), but no public exploit identified at time of analysis and the issue is not in CISA KEV.
Business-logic authentication bypass in Postiz self-hosted AI social media scheduler (gitroomhq/postiz-app) before 2.21.8 lets a low-privileged authenticated user grant any organization a lifetime PRO subscription without paying. The Nowpayments IPN (Instant Payment Notification) callback handler never validated the provider's shared-secret signature and trusted the subscription/organization identifier straight from the request body, so an attacker could forge a payment-confirmation callback. No public exploit identified at time of analysis and the issue is not in CISA KEV; it was privately reported and fixed by removing the crypto-payment code path entirely.
Privilege escalation to SUPERADMIN in Postiz (gitroomhq/postiz-app) versions prior to 2.21.8 allows any authenticated user to forge session JWTs and impersonate arbitrary organizations. The Skool integration callback signed an attacker-controlled JSON blob into a session-shape JWT using the application's JWT_SECRET, and the auth middleware blindly trusted every claim without re-resolving the user from the database. No public exploit identified at time of analysis, but the fix commit is public and the root cause is trivially reproducible from the patch diff.
Stored cross-site scripting in Postiz (gitroomhq/postiz-app) versions 2.21.6 through 2.21.6 lets any authenticated user who can create a post inject arbitrary HTML into post content by tampering with their own save request, then weaponize it via the public preview link /p/<postId>?share=true. Because the preview page renders the stored markup with dangerouslySetInnerHTML on the main application origin, a shared link executes attacker JavaScript in a victim's authenticated session context. There is no public exploit identified at time of analysis and EPSS is very low (0.04%), but SSVC rates the technical impact as total; the issue is fixed in 2.21.7.
Arbitrary code execution and privileged token theft affects Postiz (gitroomhq/postiz-app) prior to commit da44801 through an insecure GitHub Actions 'Pwn Request' pattern in the Build and Publish PR Docker Image workflow. Because the workflow triggers on pull_request_target with 'permissions: write-all' yet checks out and builds the untrusted fork head (Dockerfile.dev), any unauthenticated GitHub user can open a fork PR with a malicious Dockerfile.dev to run code on the runner and exfiltrate a write-all GITHUB_TOKEN, effectively hijacking the repository's CI/CD supply chain. Rated CVSS 10.0 with SSVC technical impact 'total' and automatable 'yes', but EPSS is low (0.14%) with no public exploit or KEV listing at time of analysis.
File upload validation bypass in Postiz social media scheduler (versions before 2.21.6) allows authenticated users to upload executable file types (HTML, SVG) with spoofed Content-Type headers, achieving stored XSS when nginx serves files using their original extensions. Attackers can hijack sessions and take over other user accounts. CVSS 8.9 (High) reflects network attack vector with low complexity requiring only low-privilege authentication and user interaction. EPSS data not provided. Not listed in CISA KEV. Vendor patch released in version 2.21.6.
Server-side request forgery in Postiz (gitroomhq postiz-app) versions prior to 2.21.5 allows unauthenticated remote attackers to access internal network resources and exfiltrate sensitive data via the /api/public/stream endpoint. The vulnerability exploits inadequate redirect validation: attackers supply public HTTPS URLs that pass initial validation but redirect server requests to private internal hosts, bypassing security controls. High confidentiality impact with potential service disruption. No public exploit identified at time of analysis.
Server-side request forgery in Postiz AI social media scheduling tool (versions < 2.21.3) allows unauthenticated remote attackers to read internal network resources and cloud metadata endpoints through the /public/stream proxy endpoint. The vulnerability bypasses trivial .mp4 validation via query parameters or URL fragments, enabling unauthorized access to internal services without authentication. No public exploit identified at time of analysis, but CVSS 8.6 reflects high confidentiality impact with network-level attack vector and low complexity. EPSS data not available, but the combination of no authentication requirement and cloud metadata access risk makes this a priority for organizations running Postiz in cloud environments.
Server-side request forgery (SSRF) in Postiz social media scheduling tool versions prior to 2.21.3 allows authenticated API users to fetch arbitrary URLs by exploiting the POST /public/v1/upload-from-url endpoint, which performs server-side URL fetching via axios without SSRF protections and relies solely on a bypassable file extension check. Attackers can retrieve internal network resources, cloud metadata, and internal service data, with responses captured and returned to the attacker. Vendor-released patch available in version 2.21.3.
Information disclosure in Postiz (gitroomhq/postiz-app) prior to v2.25.1 causes two API endpoints to return full database rows rather than the limited field sets clients require, exposing secrets to callers who should not receive them. The public API's channel-delete operation returns the deleted integration row including the channel's platform access and refresh tokens, so a third-party OAuth app holding delete permission can obtain social-platform credentials and act against the connected account outside Postiz, while GET /user/organizations returns each organization row - including the admin-only organization API key - to every member regardless of role, letting a low-privileged member call the public API on the organization's behalf. Exploitation requires a valid Postiz session, API key, or OAuth token already belonging to the target organization (authentication requirements: authenticated per the assessed vector CVSS:4.0/.../PR:L); there is no anonymous access and no cross-tenant exposure, no public exploit code was identified at time of analysis, and the flaw is fixed in v2.25.1, making this a genuine but moderate-severity disclosure rather than a top-priority emergency.
Unauthenticated exploitation of Postiz's `/public/modify-subscription` endpoint allowed any caller in possession of a validly signed NowPayments callback token to trigger subscription enforcement side effects against their own organization - disabling team members, dropping integrations, and resetting the scheduled-post cron - without Postiz authentication. The flaw (CWE-345) stems from the NowPayments crypto payment integration: the endpoint verified the token's cryptographic signature but never validated its intended purpose or bound it to a specific subscription-modification context. Impact is strictly self-contained; the endpoint cannot be redirected at other tenants. No public exploit code and no CISA KEV listing have been identified at time of analysis. The issue is fixed in Postiz 2.21.8.
DNS rebinding exploits a TOCTOU flaw in Postiz v2.16.6-2.21.6 to bypass all SSRF protections added in v2.21.4-v2.21.6, allowing unauthenticated remote attackers to reach internal network services and cloud metadata endpoints. The root defect is architectural: `isSafePublicHttpsUrl()` validates an IP via one DNS resolution, but the subsequent `fetch()` call performs its own independent DNS resolution - an attacker controlling a DNS server can return a legitimate public IP on the first query and swap to an internal address (e.g., 169.254.169.254) on the second. No public exploit has been identified and exploitation is not confirmed by CISA KEV, but the high confidentiality impact reflects realistic cloud-credential theft via IMDSv1-style metadata services.
Server-side request forgery (SSRF) in Postiz prior to version 2.21.4 allows authenticated users to create webhooks pointing to internal or private network addresses, which are then fetched without runtime validation when posts are published, enabling blind SSRF attacks against internal services. The vulnerability stems from inconsistent input validation: the webhook creation endpoint (POST /webhooks/) uses only basic URL format checking, while the update and test endpoints correctly enforce strict URL validation. CVSS 5.4 with EPSS exploitation probability reflects the requirement for authentication and limited direct impact, though the ability to target internal infrastructure represents meaningful risk.