---
id: CVE-2026-115933
title: >-
  Forged signed tokens let any registered user take over other users and
  organizations
summary: >-
  Postiz signs its session, invitation and password reset tokens with one shared
  secret and without any marker of what a token is for. A route that refreshes
  the credentials of a browser-extension channel signed data taken from the
  request…
severity: critical
cvss: 9.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-290
  - CWE-345
  - CWE-915
vendor: GitroomHQ
product: postiz-app
affected:
  - postiz-app >= 2.15.0 < 2.25.3
published: '2026-10-24'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T14:29:17.141Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115933'
references:
  - url: 'https://github.com/gitroomhq/postiz-app'
    label: Postiz
  - url: 'https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3'
    label: v2.25.3
  - url: >-
      https://github.com/gitroomhq/postiz-app/commit/a5affe62c74e39c1e7ac960d50d8418b807d532c
    label: a5affe62
  - url: 'https://gadvisory.org/advisories/PSA-2026-YT2HMH'
    label: GAdvisory
tags:
  - cve.org
ingestedAt: '2026-10-24T15:00:18.041Z'
---

## Overview

Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token.

A second, narrower route that creates team invitations signs extra fields from the request body in the same way.

## Affected

- `postiz-app >= 2.15.0 < 2.25.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

If you do not use channels that rely on the Postiz browser extension, block POST /integrations/extension-refresh at your reverse proxy. This removes the main signing route; the team invitation route remains.
Set DISABLE_REGISTRATION=true. The attacker needs an ordinary account, so closing self-registration limits exposure to people who already hold one. This reduces reach, it does not close the issue.