CVE-2026-48783

Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back, allowing a user to obtain a validly signed token containing any claims they choose, accepted as a session, an organization invitation with a chosen role, a password reset or an enterprise provisioning token.

In Postiz, a media path that is not a web address is treated as a file on the server's disk without verifying it lies inside the upload directory. A registered user can store a crafted media path with a post and cause the publishing worker to read an arbitrary file and send it as an attachment to a Discord server the user controls. The same unconfined reads are reachable through two further routes, including file existence checks and backend memory exhaustion; self-registration is open by default.

Postiz lets a signed-in user ask the backend to run a function on one of their connected channels, but the backend did not restrict which functions could be requested, allowing calls to internal helpers. One helper reads a file from the server's disk (e.g., environment file with the session signing secret, database address, and service credentials), and another makes the backend process exit with a single request. Self-registration is open by default, so no existing account or action by another user is needed.

Postiz generates security-sensitive credentials using Math.random() instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8's deterministic xorshift128+ PRNG state. An unauthenticated OAuth dynamic client registration endpoint exposes freshly generated client credentials, giving attackers enough consecutive PRNG output to reconstruct that internal state and derive past and future values.

Postiz, an open-source social media scheduling tool, has a path traversal vulnerability in the route serving locally stored media. The route requires no authentication and does not normalize paths, allowing an unauthenticated attacker to read any file readable by the process, including environment variables with JWT secrets and database credentials.

Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, an attacker could exploit a vulnerability in the Skool integration to forge a SUPERADMIN session, allowing impersonation of arbitrary organizations.

Postiz, an AI social media scheduling tool, prior to commit da44801 contains a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow. Any unauthenticated user can execute arbitrary code during the Docker build process and exfiltrate a highly privileged GITHUB_TOKEN (write-all permissions) by opening a Pull Request from a fork with a maliciously modified Dockerfile.dev.

Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the caller is not meant to receive: the public API's channel delete returns the channel's platform access token and refresh token, and GET /user/organizations returns each organization's API key to every member. Both endpoints require a valid session, API key or OAuth token and are scoped to the caller's own organization.

A vulnerability in Postiz, an AI social media scheduling tool, allows a low-privileged account to grant arbitrary organizations lifetime PRO subscriptions without payment. The issue stems from missing verification of Nowpayments IPN callback authenticity and reading the subscription identifier from an untrusted request body.

Postiz from version 2.21.6 to before 2.21.7 allows any authenticated user who can create a post to store arbitrary HTML in post content. The public preview link renders that HTML with dangerouslySetInnerHTML on the main application origin.