Postiz Security Advisories
All advisories
PSA-2026-2CAQ96CVE-2026-48781GCVE-125-2026-2CAQ96May 22, 2026Assigned May 22, 2026
8.7 High

SUPERADMIN takeover via Skool-provider JWT forgery

Attackers can exploit the skool-provider JWT sign process to generate a JWT token with isSuperAdmin: true

Affected (1)

  • gitroomhqpostiz-app
    • ≥ 0Fixed in 2.21.8Affected

    All other versions: Unaffected

Mitigations

Workarounds

  • No workaround is currently known, other than upgrading to v2.21.8.

Solutions

  • The only solution, currently known, is upgrading to v2.21.8.

Overview

Postiz's Skool integration callback signed an attacker-controlled JSON blob into a session-shape JWT using the application's JWT_SECRET, and the auth middleware trusted every claim in that JWT without re-resolving the user from the database. Any authenticated Postiz user could forge a SUPERADMIN session and impersonate arbitrary organizations.

Severity

CVSS v4
8.7 High
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
Low
User Interaction
None
Vuln Confidentiality
High
Vuln Integrity
High
Vuln Availability
High
Sub Confidentiality
High
Sub Integrity
High
Sub Availability
High
CVSS v3
9.9 Critical
9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Weaknesses (3)

References (2)

Credits (3)

  • Nedum
    Reporter · @nedu-m
  • Enno Gelhaus
    Coordinator · @egelhaus
  • Nevo David
    Remediation developer · @nevo-david

Context

Impacts

  • Full Access to all parts of Postiz.

  • Access to all users registered to that instance.

  • Ability to post in the name of the victim's social media channels added to that Postiz instance.

Timeline

  1. 05/22/2026 11:21

    Postiz has received the report of the advisory.

  2. 05/22/2026 12:00

    Postiz has verified the vulnerability.

  3. 05/22/2026 12:16

    Postiz has developed and verified the fix.

  4. 05/22/2026 18:30

    Postiz has released the developed fix, and published the advisory.

  5. 05/22/2026 21:00

    GitHub has issued CVE-2026-48781 for this advisory.