Zero Radar
← feed
CriticalVulnerabilityCVE-2026-115933updated 25 Oct 2026, 17:20 UTC

Postiz: users can forge login and invitation tokens, enabling takeover

A flaw in Postiz lets a logged-in user create their own valid security tokens and use them as if the system had issued them. This can let them log in as someone else or grant themselves higher access.

Official, 2 sources
SeverityCriticalCVSS 9.9 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Logged-in userAny account holder can start the attack
  2. 2Channel refresh routeSigns request data it should not trust
  3. 3Shared signing secretSame key signs sessions and invitations
  4. 4Forged tokenCarries chosen role or identity claims
  5. 5App accepts tokenTreated as login, invite or reset
  6. ResultAttacker gains another user's or higher access

What happened

Postiz signs its session, invitation and password reset tokens with one shared secret and no marker of their purpose. A route that refreshes browser-extension channel credentials signs attacker-controlled request data and stores the result where the user can read it back, letting them obtain validly signed tokens with arbitrary claims.

Why it is dangerous: A user can be treated as any other user, including an administrator, or be given an invitation with a chosen role or a password reset. Organizations running Postiz with multiple users are at serious risk of account takeover and unauthorized access.

Are you affected?

You are affected if you run Postiz with the vulnerable token-signing and channel-refresh code, since any user with an account can exploit it.

Postiz (versions not specified in the provided material)

What to do

  1. Check the GitHub advisory GHSA-9j6f-8rw3-93c4 for the patched Postiz version and update to it
  2. If no patch is available yet, restrict who can create accounts or log in to Postiz until fixed
  3. Review account activity and invitations for unexpected role changes or unknown users

Timeline

  1. 24 Oct 2026, 15:17 UTC
    Publicly disclosed
  2. 24 Oct 2026, 15:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 17:20 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-115933 · GHSA-9j6f-8rw3-93c4
CVSS
9.9 / 10
EPSS
0.2% chance of exploitation within 30 days
Disclosed
24 Oct 2026, 15:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Postiz: users can forge login and invitation tokens, enabling takeover · Zero Radar