gitroomhq postiz-app
20 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-115933 | 2.15.0 – < 2.25.3 | Forged signed tokens let any registered user take over other users and organizations | CRITICAL 9.9 | 0.2 % | ||
| CVE-2026-115932 | 2.23.0 – < 2.25.3 | Path traversal in post media lets any registered user read server files | CRITICAL 9.6 | 0.4 % | ||
| CVE-2026-115931 | 2.23.0 – < 2.25.2 | Arbitrary file read and backend crash through unrestricted provider method calls | CRITICAL 9.9 | 0.5 % | ||
| CVE-2026-107761 | < 2.25.1 | Channel tokens and organization API key exposed in API responses | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-94455 | < 2.4.0 | Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key | HIGH 7.1 | 0.3 % | ||
| CVE-2026-94456 | < 2.4.0 | Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-19264 | < 2.22.1 | Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover | CRITICAL 9.3 | 1.0 % | ||
| CVE-2026-19127 | < 2.21.10 | Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-48799 | < 2.21.8 | Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook | HIGH 7.7 | 0.2 % | ||
| CVE-2026-48783 | < 2.21.8 | Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription | MEDIUM 4.8 | 0.2 % | ||
| CVE-2026-48781 | < 2.21.8 | Postiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgery | CRITICAL 9.9 | 0.2 % | ||
| CVE-2026-42556 | >= 2.21.6, < 2.21.7 | Postiz stored XSS in public preview page | CRITICAL 9.0 | 0.3 % | ||
| CVE-2026-42346 | >= 2.16.6, < 2.21.7 | Postiz: TOCTOU DNS rebinding bypasses all SSRF URL validation paths | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-42298 | < da448012dd87e94944cbe83a38e7fd023269ec46 | Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev | CRITICAL 10.0 | 0.5 % | ||
| CVE-2026-40487 | < 2.21.6 | Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS | CRITICAL 9.0 | 0.2 % | ||
| CVE-2026-40168 | < 2.21.5 | Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream | HIGH 8.2 | 0.4 % | ||
| CVE-2026-34590 | < 2.21.4 | Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-34577 | < 2.21.3 | Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check | HIGH 8.6 | 0.5 % | ||
| CVE-2026-34576 | < 2.21.3 | Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata | HIGH 8.3 | 0.3 % | ||
| CVE-2025-53641 | >= 1.45.1, < 1.62.3 | Postiz allows header mutation in middleware facilitates resulting in SSRF | HIGH 8.2 | 0.3 % |