Postiz: forged signed tokens and post-media path traversal let any registered user take over orgs and read server files (CVE-2026-115933, CVE-2026-115932)

Postiz (gitroomhq/postiz-app), self-hosted

Two critical bugs in the self-hosted Postiz social media scheduler, both reported with working PoCs by Anthropic. Postiz signed session, invite and password-reset tokens with one shared secret and no purpose marker, and an extension-refresh route signed request data, so any registered user could forge tokens and become super admin of another organization (CVE-2026-115933, CVSS 9.9). A separate path traversal in post media let a registered user have the worker send any server file, including the JWT secret and env file, to their own Discord server (CVE-2026-115932, CVSS 9.6). Both are fixed in Postiz 2.25.3; self-registration is open by default, so upgrade now.

Why this severity: CVSS 9.9 (token forgery) and 9.6 (file read), any self-registered user, PoCs demonstrated end to end; no reported exploitation

Started: Oct 24, 2026
CVEs: CVE-2026-115933 CVE-2026-115932

Follow this incident

Updated Oct 24, 2026, 14:55 UTC

Affected

postiz-app 2.15.0 to before 2.25.3 (CVE-2026-115933, forged tokens)
postiz-app 2.23.0 to before 2.25.3 (CVE-2026-115932, path traversal; main route needs the Discord provider configured)

Fixed in

postiz-app 2.25.3

Timeline2

Oct 24, 2026
Postiz 2.25.3 ships fixes for PSA-2026-E9AHFV (CVE-2026-115932, path traversal) and PSA-2026-YT2HMH (CVE-2026-115933, forged tokens); all users are told to upgrade immediately. Workarounds until then: set DISABLE_REGISTRATION=true and block POST /integrations/extension-refresh at the reverse proxy.
Oct 23, 2026
Anthropic reports both bugs to Postiz with working PoCs (17:45 UTC); Postiz reproduces them within 15 minutes.

Advisories5

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified

Become a sponsor