Zero Radar
← feed
CriticalVulnerabilityCVE-2026-115931updated 25 Oct 2026, 17:20 UTC

Postiz: signed-in users can read server files and crash the backend

Any user with a normal account can make the server reveal its secret settings, such as the keys that protect logins and passwords for connected services. A single request can also shut the server down.

Official, 2 sources
SeverityCriticalCVSS 9.9 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker registersSelf-registration is open by default
  2. 2Signed-in requestAsks backend to run internal helper function
  3. 3Backend reads fileChannel token set to a file path
  4. 4Secrets exposedEnvironment holds session signing secret and credentials
  5. ResultAttacker gets server secrets or crashes it

What happened

Postiz's backend does not restrict which internal functions a signed-in user can trigger on a connected channel. One such helper reads files from disk based on a stored channel token, and another makes the process exit.

Why it is dangerous: An attacker can read the server's environment, including the secret used to sign login sessions, database address and credentials for connected services, then take over accounts or data. Anyone who can register on an instance with open self-registration can do this without help from another user.

Are you affected?

You are affected if you run Postiz with open self-registration (the default) or have untrusted users with accounts on your instance.

Postiz (versions not specified in the provided material)

What to do

  1. Check whether your Postiz instance allows self-registration and disable it if you do not need it
  2. Restrict account creation to trusted users until a fix is installed
  3. Rotate the session signing secret, database password and connected service credentials if the instance was open to untrusted users
  4. Watch the Postiz project and GitHub advisory GHSA-h5r5-h782-vqvp for a patched release and update as soon as one is available

Timeline

  1. 23 Oct 2026, 23:17 UTC
    Publicly disclosed
  2. 23 Oct 2026, 23:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 17:20 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-115931 · GHSA-h5r5-h782-vqvp
CVSS
9.9 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
23 Oct 2026, 23:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Postiz: signed-in users can read server files and crash the backend · Zero Radar