Postiz: Forged signed tokens allow account takeover and privilege escalation

Summary

Postiz signs session, invitation, password reset and enterprise provisioning tokens with one shared secret and without a purpose marker. A route that refreshes browser-extension channel credentials signs attacker-chosen data, so a registered user can obtain a valid token with arbitrary claims. An attacker can use it to take over other user accounts, join other organizations as super administrator and read their API keys. Exploitation needs only an ordinary account, which can be created if self-registration is open.

Affected

• GitroomHQ postiz-app 2.15.0 up to but not including 2.25.3
• Default configuration is unaffected according to the CNA record; the issue depends on the configuration noted under exploitation.

Fixed in

• Upgrade to postiz-app 2.25.3 or later (released 2026-10-24).
• Unclear: whether the 2.25.3 fix also covers the team invitation route. Verify against the fix commit a5affe62c74e39c1e7ac960d50d8418b807d532c.

Workaround

• If the Postiz browser extension is not used for channels, block POST /integrations/extension-refresh at the reverse proxy. This removes the main signing route only; the team invitation route remains exposed.
• Set DISABLE_REGISTRATION=true to limit exposure to existing accounts. This reduces reach but does not close the issue.

Exploitation

• The reporter (Anthropic) holds a working proof of concept, disclosed to the vendor. Exploitation was demonstrated end to end against an unmodified backend build.
• No public proof of concept was found and no known in-the-wild exploitation was reported.
• Not listed in CISA KEV.
• Conditions: the instance must reach api2.skool.com (default for instances using the Skool provider). With Stripe billing, the attacker's plan must allow one channel and the target organization must not be on the STANDARD tier. Session and password reset tokens are not affected by these limits.
• Forged tokens do not expire and cannot be distinguished from genuine ones.

Our recommendation

• Upgrade Postiz to version 2.25.3 or later as a priority if the instance is internet-facing or has open registration.
• Rotate the JWT signing secret after upgrading. Forged tokens created before the patch would otherwise still validate; rotation also invalidates existing session, invitation, reset and enterprise tokens, so users must sign in again.
• Set DISABLE_REGISTRATION=true unless public sign-up is required.
• Review logs for requests to POST /integrations/extension-refresh, team invitations and password resets, and for unexpected super administrator assignments.
• Check API keys of organizations for unauthorized use and rotate them if compromise is suspected.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GAdvisory PSA-2026-YT2HMH gadvisory.org
• Postiz fix commit a5affe62 github.com
• Postiz release v2.25.3 github.com
• Postiz GitHub repository github.com
• Ostorlab analysis of CVE-2026-115931 (related disclosure) blog.ostorlab.co
• CVE threat intelligence record cve.threatint.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:54.