{"id":"CVE-2026-115933","title":"Forged signed tokens let any registered user take over other users and organizations","summary":"Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request…","severity":"critical","cvss":9.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-290","CWE-345","CWE-915"],"vendor":"GitroomHQ","product":"postiz-app","affected":["postiz-app >= 2.15.0 < 2.25.3"],"published":"2026-10-24","updated":"2026-10-24","sourceUpdated":"2026-10-24T14:29:17.141Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115933","references":[{"url":"https://github.com/gitroomhq/postiz-app","label":"Postiz"},{"url":"https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3","label":"v2.25.3"},{"url":"https://github.com/gitroomhq/postiz-app/commit/a5affe62c74e39c1e7ac960d50d8418b807d532c","label":"a5affe62"},{"url":"https://gadvisory.org/advisories/PSA-2026-YT2HMH","label":"GAdvisory"}],"tags":["cve.org"],"ingestedAt":"2026-10-24T15:00:18.041Z","slug":"CVE-2026-115933","body":"## Overview\n\nPostiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token.\n\nA second, narrower route that creates team invitations signs extra fields from the request body in the same way.\n\n## Affected\n\n- `postiz-app >= 2.15.0 < 2.25.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nIf you do not use channels that rely on the Postiz browser extension, block POST /integrations/extension-refresh at your reverse proxy. This removes the main signing route; the team invitation route remains.\nSet DISABLE_REGISTRATION=true. The attacker needs an ordinary account, so closing self-registration limits exposure to people who already hold one. This reduces reach, it does not close the issue.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":54.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}