{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"state":"PUBLISHED","datePublished":"2026-04-19T12:40:26.119Z","dateUpdated":"2026-08-10T19:20:44.680Z","assignerShortName":"Postiz","vulnId":"GCVE-125-2026-04-PY6V","cveId":"CVE-2025-53641"},"containers":{"cna":{"providerMetadata":{"shortName":"Postiz","dateUpdated":"2026-08-10T19:20:44.680Z"},"title":"Header mutation in middleware facilitates SSRF","descriptions":[{"lang":"en","value":"A vulnerability has been identified in the Postiz frontend application that allows an attacker to inject arbitrary HTTP headers into the middleware pipeline. This flaw enables a server-side request forgery (SSRF) condition, which can be exploited to initiate unauthorized outbound requests from the server hosting the Postiz application."}],"affected":[{"vendor":"gitroomhq","product":"postiz-app","packageName":"postiz-app","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"custom","lessThan":"1.62.3"}]}],"references":[{"url":"https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-48c8-25jq-m55f","tags":["vendor-advisory"],"name":"GHSA"},{"url":"https://github.com/gitroomhq/postiz-app/releases/tag/v1.62.3","tags":["patch"],"name":"v1.62.3"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","baseScore":8.2,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-918","cweId":"CWE-918","type":"CWE"}]}],"credits":[{"lang":"en","value":"Dominik Prodinger","type":"reporter"},{"lang":"en","value":"Enno Gelhaus","type":"coordinator"},{"lang":"en","value":"Nevo David","type":"remediation developer"}],"datePublic":"2026-04-19T12:40:26.119Z","x_gcve":[{"vulnId":"GCVE-125-2026-04-PY6V","recordType":"advisory","relationships":[{"destId":"CVE-2025-53641","type":"equal"},{"destId":"GHSA-48c8-25jq-m55f","type":"equal"}]}]}}}
{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"state":"RESERVED","datePublished":"2026-04-19T12:42:37.382Z","dateUpdated":"2026-08-10T19:20:44.717Z","assignerShortName":"Postiz","vulnId":"GCVE-125-2026-04-ZR1M"},"containers":{"cna":{"providerMetadata":{"shortName":"Postiz","dateUpdated":"2026-08-10T19:20:44.717Z"},"title":"Multiple SSRF Vectors - Webhooks, RSS Feed, URL Loader (CWE-918)","descriptions":[{"lang":"en","value":"Postiz has multiple SSRF vulnerabilities where user-provided URLs are fetched server-side without any IP validation or SSRF protection."}],"affected":[{"vendor":"gitroomhq","product":"postiz-app","packageName":"postiz-app","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"custom","lessThan":"2.21.2"}]}],"references":[{"url":"https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.2","tags":["patch"],"name":"v2.21.2"},{"url":"https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-89v5-38xr-9m4j","tags":["related"],"name":"GHSA"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-918","cweId":"CWE-918","type":"CWE"}]}],"credits":[{"lang":"en","value":"Kevin Chen","type":"reporter"},{"lang":"en","value":"Enno Gelhaus","type":"coordinator"},{"lang":"en","value":"Nevo David","type":"remediation developer"}],"datePublic":"2026-04-19T12:42:37.382Z","solutions":[{"lang":"en","value":"Upgrading to version v2.21.2 or later."}],"impacts":[{"descriptions":[{"lang":"en","value":"Impacts could include: \n- Cloud metadata theft: AWS/GCP/Azure credentials\n- Internal network scanning: Full access to private IP ranges\n- Multiple entry points: Webhooks, RSS feeds, URL loader all vulnerable"}]}],"timeline":[{"time":"2026-03-04T20:33:00.000Z","lang":"en","value":"Report has been disclosed privately to Postiz."},{"time":"2026-03-25T10:24:00.000Z","lang":"en","value":"Postiz acknowledged the report."},{"time":"2026-03-25T10:48:00.000Z","lang":"en","value":"Postiz created a fix, created a release (v2.21.2) and published the advisory."}],"x_gcve":[{"vulnId":"GCVE-125-2026-04-ZR1M","recordType":"advisory","relationships":[{"destId":"GHSA-89v5-38xr-9m4j","type":"equal"}]}]}}}
{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"state":"PUBLISHED","datePublished":"2026-04-19T13:16:18.763Z","dateUpdated":"2026-08-10T19:20:44.757Z","assignerShortName":"Postiz","vulnId":"GCVE-125-2026-04-SRGA","cveId":"CVE-2024-34351"},"containers":{"cna":{"providerMetadata":{"shortName":"Postiz","dateUpdated":"2026-08-10T19:20:44.757Z"},"title":"High-Severity SSRF in Postiz App","descriptions":[{"lang":"en","value":"### Impact\nA successful SSRF attack allows an attacker to:\n- Bypass firewalls to scan and interact with internal network services/ports.\n- Access sensitive cloud metadata services (e.g., AWS IMDS 169.254.169.254) to potentially leak instance credentials.\n- Pivot into the internal network environment where Postiz is hosted.\n\n### Workarounds\nThere are no workarounds known to this, please upgrade to Postiz version `v2.21.1`.\n\n### References\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-34351\nhttp://cwe.mitre.org/data/definitions/918.html\nhttps://github.com/vercel/next.js/security/advisories/GHSA-fr5h-rqp8-mj6g"}],"affected":[{"vendor":"gitroomhq","product":"postiz-app","packageName":"postiz-app","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"custom","lessThan":"2.21.1"}]}],"references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-fr5h-rqp8-mj6g","tags":["vendor-advisory"],"name":"GHSA (Next.js)"},{"url":"https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-vj2p-7pgw-g2wf","tags":["vendor-advisory"],"name":"GHSA (Postiz)"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34351","tags":["technical-description"],"name":"CVE-2024-34351"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-918","cweId":"CWE-918","type":"CWE"}]}],"credits":[{"lang":"en","value":"Enno Gelhaus","type":"coordinator"},{"lang":"en","value":"Nevo David","type":"remediation developer"}],"datePublic":"2026-04-19T13:16:18.763Z","solutions":[{"lang":"en","value":"Upgrade to v2.21.1 or later."}],"exploits":[{"lang":"en","value":"Access to the internal network / services where Postiz is hosted."}],"impacts":[{"descriptions":[{"lang":"en","value":"Impacts could include:\n- Access sensitive cloud metadata services (e.g., AWS IMDS 169.254.169.254) to potentially leak instance credentials.\n- Access to sensitive internal services on the internal network.\n- Access to services used by Postiz. (Like Redis, PostgreSQL, Temporal etc.)"}]}],"timeline":[{"time":"2026-03-24T14:58:00.000Z","lang":"en","value":"Postiz received the initial report for the vulnerability."},{"time":"2026-03-25T10:15:00.000Z","lang":"en","value":"Postiz developed the fix, verified it, created the release and published the advisory."}],"x_gcve":[{"vulnId":"GCVE-125-2026-04-SRGA","recordType":"advisory","relationships":[{"destId":"CVE-2024-34351","type":"equal"},{"destId":"GHSA-vj2p-7pgw-g2wf","type":"equal"}]}]}}}
{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"state":"PUBLISHED","datePublished":"2026-04-19T13:29:12.103Z","dateUpdated":"2026-08-10T19:20:44.833Z","assignerShortName":"Postiz","vulnId":"GCVE-125-2026-04-422G","cveId":"CVE-2026-34577"},"containers":{"cna":{"providerMetadata":{"shortName":"Postiz","dateUpdated":"2026-08-10T19:20:44.833Z"},"title":"Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check","descriptions":[{"lang":"en","value":"The `GET /public/stream` endpoint in `PublicController` accepts a user-supplied `url` query parameter and proxies the full HTTP response back to the caller. The only validation is `url.endsWith('mp4')`, which is trivially bypassable by appending `.mp4` as a query parameter value or URL fragment. The endpoint requires no authentication and has no SSRF protections, allowing an unauthenticated attacker to read responses from internal services, cloud metadata endpoints, and other network-internal resources."}],"affected":[{"vendor":"gitroomhq","product":"postiz-app","packageName":"postiz-app","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"custom","lessThan":"2.21.3"}]}],"references":[{"url":"https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-mv6h-v3jg-g539","tags":["vendor-advisory"],"name":"GHSA"},{"url":"https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.3","tags":["patch"],"name":"v2.21.3"},{"url":"https://github.com/gitroomhq/postiz-app/compare/13fedeca8b600bc48c9a7db500f3f9ebdc261c2c..6f7a80f689bc46f2d0b023e4eac9e3d3ea7c2d01","tags":["patch"],"name":"13fedec"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":8.6,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-918","cweId":"CWE-918","type":"CWE"}]}],"credits":[{"lang":"en","value":"offset","type":"reporter"},{"lang":"en","value":"Enno Gelhaus","type":"coordinator"},{"lang":"en","value":"Nevo David","type":"remediation developer"}],"datePublic":"2026-04-19T13:29:12.103Z","solutions":[{"lang":"en","value":"Upgrade to v2.21.3 or later."}],"exploits":[{"lang":"en","value":"Full-Read Access to the internal network."}],"impacts":[{"descriptions":[{"lang":"en","value":"Impacts could include:\n- Cloud credential theft: An attacker can read AWS/GCP/Azure instance metadata endpoints to steal IAM credentials, service account tokens, and other cloud secrets. This can lead to full cloud account compromise.\n- Internal network reconnaissance: The attacker can scan and read from internal services (databases, caches, admin panels) that are not exposed to the internet.\n- Data exfiltration: Any HTTP-accessible internal resource can be read and its content returned to the attacker.\n- Chaining potential: Stolen cloud credentials or internal service access can be leveraged for lateral movement, privilege escalation, and further exploitation."}]}],"timeline":[{"time":"2026-03-28T13:05:00.000Z","lang":"en","value":"Postiz received the initial report of the vulnerability."},{"time":"2026-03-28T16:57:00.000Z","lang":"en","value":"Postiz acknowledged and verified the vulnerability."},{"time":"2026-03-29T07:15:00.000Z","lang":"en","value":"Postiz developed the fix, verified it works, created the release and published the advisory."},{"time":"2026-03-30T17:52:00.000Z","lang":"en","value":"GitHub assigned the CVE CVE-2026-34577 for this advisory."}],"x_gcve":[{"vulnId":"GCVE-125-2026-04-422G","recordType":"advisory","relationships":[{"destId":"CVE-2026-34577","type":"equal"},{"destId":"GHSA-mv6h-v3jg-g539","type":"equal"}]}]}}}
{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"state":"PUBLISHED","datePublished":"2026-04-19T14:14:24.222Z","dateUpdated":"2026-08-10T19:20:44.945Z","assignerShortName":"Postiz","vulnId":"GCVE-125-2026-04-KT4W","cveId":"CVE-2026-34576"},"containers":{"cna":{"providerMetadata":{"shortName":"Postiz","dateUpdated":"2026-08-10T19:20:44.945Z"},"title":"SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata","descriptions":[{"lang":"en","value":"The `POST /public/v1/upload-from-url` endpoint accepts a user-supplied URL and fetches it server-side using `axios.get()` with no SSRF protections. The only validation is a file extension check (`.png`, `.jpg`, etc.) which is trivially bypassed by appending an image extension to any URL path. An authenticated API user can fetch internal network resources, cloud instance metadata, and other internal services, with the response data uploaded to storage and returned to the attacker."}],"affected":[{"vendor":"gitroomhq","product":"postiz-app","packageName":"postiz-app","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"custom","lessThan":"2.21.3"}]}],"references":[{"url":"https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-89vp-m2qw-7v34","tags":["vendor-advisory"],"name":"GHSA"},{"url":"https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.3","tags":["patch"],"name":"v2.21.3"}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","baseScore":4.8,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-918","cweId":"CWE-918","type":"CWE"}]}],"credits":[{"lang":"en","value":"offset","type":"reporter"},{"lang":"en","value":"Enno Gelhaus","type":"coordinator"},{"lang":"en","value":"Nevo David","type":"remediation developer"}],"datePublic":"2026-04-19T14:14:24.222Z","solutions":[{"lang":"en","value":"Upgrade to v2.21.3 or later."}],"exploits":[{"lang":"en","value":"Access to internal network ressources."}],"impacts":[{"descriptions":[{"lang":"en","value":"Impacts could include:\n- Steal cloud credentials: Access AWS/GCP/Azure instance metadata endpoints to obtain IAM role credentials, potentially leading to full cloud infrastructure compromise.\n- Scan internal networks: Enumerate internal services, ports, and hosts that are not directly accessible from the internet.\n- Access internal services: Read data from internal databases, admin panels, caches (Redis), and other services on the internal network.\n- Exfiltrate data: All fetched responses are uploaded to cloud storage and a download URL is returned, providing a full data exfiltration channel."}]}],"timeline":[{"time":"2026-03-28T13:05:00.000Z","lang":"en","value":"Postiz has received the advisory."},{"time":"2026-03-28T17:04:00.000Z","lang":"en","value":"Postiz acknowledged and verified the advisory."},{"time":"2026-03-29T07:15:00.000Z","lang":"en","value":"Postiz has developed the fix, verified it, created the release and published the advisory."},{"time":"2026-03-30T17:51:00.000Z","lang":"en","value":"GitHub has assigned the CVE-2026-34576."}],"x_gcve":[{"vulnId":"GCVE-125-2026-04-KT4W","recordType":"advisory","relationships":[{"destId":"CVE-2026-34576","type":"equal"},{"destId":"GHSA-89vp-m2qw-7v34","type":"equal"}]}]}}}
{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"state":"PUBLISHED","datePublished":"2026-04-19T17:45:50.579Z","dateUpdated":"2026-08-10T19:20:45.000Z","assignerShortName":"Postiz","vulnId":"GCVE-125-2026-04-HVBM","cveId":"CVE-2026-34590"},"containers":{"cna":{"providerMetadata":{"shortName":"Postiz","dateUpdated":"2026-08-10T19:20:45.000Z"},"title":"SSRF via Webhook Creation Endpoint Missing URL Safety Validation","descriptions":[{"lang":"en","value":"The `POST /webhooks/` endpoint for creating webhooks uses `WebhooksDto` which validates the `url` field with only `@IsUrl()` (format check), missing the `@IsSafeWebhookUrl` validator that blocks internal/private network addresses. The update (`PUT /webhooks/`) and test (`POST /webhooks/send`) endpoints correctly apply `@IsSafeWebhookUrl`. When a post is published, the orchestrator fetches the stored webhook URL without runtime validation, enabling blind SSRF against internal services."}],"affected":[{"vendor":"gitroomhq","product":"postiz-app","packageName":"postiz-app","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"custom","lessThan":"2.21.4"}]}],"references":[{"url":"https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-wc9c-7cv8-m225","tags":["vendor-advisory"],"name":"GHSA"},{"url":"https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.4","tags":["patch"],"name":"v2.21.4"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-918","cweId":"CWE-918","type":"CWE"}]}],"credits":[{"lang":"en","value":"offset","type":"reporter"},{"lang":"en","value":"Enno Gelhaus","type":"coordinator"},{"lang":"en","value":"Enno Gelhaus","type":"remediation developer"}],"datePublic":"2026-04-19T17:45:50.579Z","dateAssigned":"2026-03-30T18:44:00.000Z","solutions":[{"lang":"en","value":"Upgrade to v2.21.4 or later."}],"exploits":[{"lang":"en","value":"Access to internal network / ressources."}],"impacts":[{"descriptions":[{"lang":"en","value":"Impacts could include:\n- Internal network scanning: An attacker can probe internal hosts and ports via timing differences in webhook delivery. Even though responses are not returned, reachability can be inferred.\n- Blind interaction with internal services: The SSRF sends POST requests with attacker-influenced body content (serialized post data) to internal services. Services without authentication (e.g., internal APIs, caches, message queues) could be manipulated.\n- Cloud metadata access: On cloud deployments (AWS, GCP, Azure), the instance metadata service at 169.254.169.254 may be reachable, potentially exposing IAM credentials or instance configuration. While the response is not reflected to the attacker, the POST request itself reaches the metadata service.\n- Persistence: The malicious webhook URL is stored in the database and triggered on every post publication until deleted, creating a persistent SSRF primitive."}]}],"timeline":[{"time":"2026-03-28T13:05:00.000Z","lang":"en","value":"Postiz received the advisory."},{"time":"2026-03-29T15:55:00.000Z","lang":"en","value":"Postiz acknowledged and verified the advisory."},{"time":"2026-03-29T16:00:00.000Z","lang":"en","value":"Postiz developed the fix, verified it, created the release and published the advisory."},{"time":"2026-03-30T18:44:00.000Z","lang":"en","value":"GitHub issued CVE-2026-34590 for this advisory."}],"x_gcve":[{"vulnId":"GCVE-125-2026-04-HVBM","recordType":"advisory","relationships":[{"destId":"CVE-2026-34590","type":"equal"},{"destId":"GHSA-wc9c-7cv8-m225","type":"equal"}]}]}}}
{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"state":"PUBLISHED","datePublished":"2026-04-19T17:59:35.247Z","dateUpdated":"2026-08-10T19:20:45.088Z","assignerShortName":"Postiz","vulnId":"GCVE-125-2026-04-5MVG","cveId":"CVE-2026-0003"},"containers":{"cna":{"providerMetadata":{"shortName":"Postiz","dateUpdated":"2026-08-10T19:20:45.088Z"},"title":"Unrestricted File Upload via MIME Type Spoofing Leads to Stored XSS","descriptions":[{"lang":"en","value":"A file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the `Content-Type` header. The uploaded files are then served by nginx with a Content-Type derived from their original extension (`text/html`, `image/svg+xml`), enabling Stored Cross-Site Scripting (XSS) in the context of the application's origin. This can lead to session riding, account takeover, and full compromise of other users' accounts."}],"affected":[{"vendor":"gitroomhq","product":"postiz-app","packageName":"postiz-app","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"custom","lessThan":"2.21.6"}],"repo":"https://github.com/gitroomhq/postiz-app"}],"references":[{"url":"https://advisory.ennogelhaus.de/dashboard/advisories/cmo62723p000sj6j7tgfbwrqp?tab=refs","tags":["vendor-advisory"],"name":"GHSA"},{"url":"https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.6","tags":["patch"],"name":"v2.21.6"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","baseScore":9,"baseSeverity":"CRITICAL"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-79","cweId":"CWE-79","type":"CWE"},{"lang":"en","description":"CWE-345","cweId":"CWE-345","type":"CWE"},{"lang":"en","description":"CWE-434","cweId":"CWE-434","type":"CWE"}]}],"credits":[{"lang":"en","value":"Lorenzo Anastasi","type":"reporter"},{"lang":"en","value":"Enno Gelhaus","type":"coordinator"},{"lang":"en","value":"Nevo David","type":"remediation developer"}],"datePublic":"2026-04-12T02:07:00.000Z","dateAssigned":"2026-04-14T13:50:00.000Z","workarounds":[{"lang":"en","value":"No reliable workaround exists prior to v2.21.6. As partial mitigation, administrators can disable file uploads or serve /uploads/ with Content-Disposition: attachment and a restrictive Content-Security-Policy in nginx to prevent inline rendering of uploaded files."}],"solutions":[{"lang":"en","value":"Upgrade to v2.21.6 or later."}],"exploits":[{"lang":"en","value":"Stored Cross-Site Scripting (XSS) that allows any authenticated user to persistently compromise other users by uploading malicious files."},{"lang":"en","value":"The application signs JWTs with no exp claim, meaning tokens never expire. Uploaded files also persist indefinitely and require no authentication to access, so any user can be targeted at any time."}],"impacts":[{"descriptions":[{"lang":"en","value":"Through clicking the upload link, the attacker can invite himself as an admin to the team, gaining full admin permissions."}]},{"descriptions":[{"lang":"en","value":"Fully removing all posts & integrations of the team."}]},{"descriptions":[{"lang":"en","value":"Gaining full API access, while impersonating the victim."}]}],"timeline":[{"time":"2026-04-10T11:37:00.000Z","lang":"en","value":"Postiz has received the advisory."},{"time":"2026-04-10T16:04:00.000Z","lang":"en","value":"Postiz has acknowledged the advisory."},{"time":"2026-04-11T23:23:00.000Z","lang":"en","value":"Postiz has verified the advisory."},{"time":"2026-04-12T04:07:00.000Z","lang":"en","value":"Postiz has developed a fix, verified it, created the release and published the advisory."},{"time":"2026-04-14T13:50:00.000Z","lang":"en","value":"GitHub has issued CVE-2026-40487 for this advisory."}],"x_gcve":[{"vulnId":"GCVE-125-2026-04-5MVG","recordType":"advisory","relationships":[{"destId":"CVE-2026-0003","type":"equal"},{"destId":"GHSA-44wg-r34q-hvfx","type":"equal"}]}]}}}
{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"state":"PUBLISHED","datePublished":"2026-04-22T15:44:29.212Z","dateUpdated":"2026-08-10T19:20:45.191Z","assignerShortName":"Postiz","vulnId":"GCVE-125-2026-04-6EZ5","cveId":"CVE-2026-40168"},"containers":{"cna":{"providerMetadata":{"shortName":"Postiz","dateUpdated":"2026-08-10T19:20:45.191Z"},"title":"Server-Side Request Forgery via Redirect Bypass in /api/public/stream","descriptions":[{"lang":"en","value":"The /api/public/stream endpoint is vulnerable to SSRF. Although the application validates the initially supplied URL and blocks direct private/internal hosts, it does not re-validate the final destination after HTTP redirects. As a result, an attacker can supply a public HTTPS URL that passes validation and then redirects the server-side request to an internal resource."}],"affected":[{"vendor":"gitroomhq","product":"postiz-app","packageName":"postiz-app","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"custom","lessThan":"2.21.5"}],"repo":"https://github.com/gitroomhq/postiz-app"}],"references":[{"url":"https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-34w8-5j2v-h6ww","tags":["vendor-advisory"],"name":"GHSA"},{"url":"https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.5","tags":["patch"],"name":"v2.21.5"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","baseScore":8.2,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-918","cweId":"CWE-918","type":"CWE"}]}],"credits":[{"lang":"en","value":"S4nso","type":"reporter"},{"lang":"en","value":"egelhaus","type":"coordinator"},{"lang":"en","value":"nevo-david","type":"remediation developer"}],"datePublic":"2026-04-22T15:44:29.212Z","dateAssigned":"2026-04-10T17:10:00.000Z","solutions":[{"lang":"en","value":"Upgrade to v2.21.5 or later."}],"exploits":[{"lang":"en","value":"Full-read access to the internal network."}],"impacts":[{"descriptions":[{"lang":"en","value":"Internal network scanning: An attacker can probe internal hosts and ports via timing differences in webhook delivery. Even though responses are not returned, reachability can be inferred."}]},{"descriptions":[{"lang":"en","value":"Blind interaction with internal services: The SSRF sends POST requests with attacker-influenced body content (serialized post data) to internal services. Services without authentication (e.g., internal APIs, caches, message queues) could be manipulated."}]},{"descriptions":[{"lang":"en","value":"Cloud metadata access: On cloud deployments (AWS, GCP, Azure), the instance metadata service at 169.254.169.254 may be reachable, potentially exposing IAM credentials or instance configuration. While the response is not reflected to the attacker, the POST request itself reaches the metadata service."}]},{"descriptions":[{"lang":"en","value":"Persistence: The malicious webhook URL is stored in the database and triggered on every post publication until deleted, creating a persistent SSRF primitive."}]}],"timeline":[{"time":"2026-04-03T08:39:00.000Z","lang":"en","value":"Postiz has received the advisory."},{"time":"2026-04-03T15:17:00.000Z","lang":"en","value":"Postiz has acknowledged and tested the advisory."},{"time":"2026-04-09T12:20:00.000Z","lang":"en","value":"Postiz has developed the fix, tested it, created the release and published the advisory."},{"time":"2026-04-10T17:10:00.000Z","lang":"en","value":"GitHub has issued CVE-2026-40168 for this advisory."}],"x_gcve":[{"vulnId":"GCVE-125-2026-04-6EZ5","recordType":"advisory","relationships":[{"destId":"CVE-2026-40168","type":"equal"},{"destId":"GHSA-34w8-5j2v-h6ww","type":"equal"}]}]}}}
{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"state":"PUBLISHED","datePublished":"2026-04-24T01:53:39.876Z","dateUpdated":"2026-08-10T19:20:45.342Z","assignerShortName":"Postiz","vulnId":"GCVE-125-2026-04-1YDY","cveId":"CVE-2026-42298"},"containers":{"cna":{"providerMetadata":{"shortName":"Postiz","dateUpdated":"2026-08-10T19:20:45.342Z"},"title":"Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev","descriptions":[{"lang":"en","value":"A critical \"Pwn Request\" vulnerability in the `Build and Publish PR Docker Image` workflow (`.github/workflows/pr-docker-build.yml`) allows any unauthenticated user to execute arbitrary code during the Docker build process and exfiltrate a highly privileged `GITHUB_TOKEN` (`write-all` permissions). This can be achieved simply by opening a Pull Request from a fork with a maliciously modified `Dockerfile.dev`."}],"affected":[{"vendor":"gitroomhq","product":"postiz-app","packageName":"postiz-app","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"custom","lessThan":"0"}],"repo":"https://github.com/gitroomhq/postiz-app"}],"references":[{"url":"https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-v975-9h5p-xhm4","tags":["vendor-advisory"],"name":"GHSA"},{"url":"https://github.com/gitroomhq/postiz-app/commit/da448012dd87e94944cbe83a38e7fd023269ec46","tags":["patch"],"name":"da44801"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10,"baseSeverity":"CRITICAL"}},{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","baseScore":9.3,"baseSeverity":"CRITICAL"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-94","cweId":"CWE-94","type":"CWE"}]}],"credits":[{"lang":"en","value":"smiotani-aeyesec","type":"reporter"},{"lang":"en","value":"Enno Gelhaus","type":"remediation developer"},{"lang":"en","value":"Enno Gelhaus","type":"coordinator"}],"datePublic":"2026-04-24T01:53:39.876Z","exploits":[{"lang":"en","value":"Full read-write access to the entire postiz-app repo."}],"impacts":[{"descriptions":[{"lang":"en","value":"Attacker gains ability to commit to the repo."}]},{"descriptions":[{"lang":"en","value":"Attacker gains ability to create releases on the repo."}]},{"descriptions":[{"lang":"en","value":"Attacker can close, open, manage PRs / Issues."}]},{"descriptions":[{"lang":"en","value":"Attacker gains full read-write access to all areas of the repo."}]}],"timeline":[{"time":"2026-04-22T06:31:00.000Z","lang":"en","value":"Postiz has received the advisory."},{"time":"2026-04-22T08:58:00.000Z","lang":"en","value":"Postiz has acknowledged the advisory."},{"time":"2026-04-22T14:22:00.000Z","lang":"en","value":"Postiz has developed the fix, tested it and published the advisory."},{"time":"2026-04-26T13:09:00.000Z","lang":"en","value":"GitHub has issued CVE-2026-42298 for this Advisory."}],"x_gcve":[{"vulnId":"GCVE-125-2026-04-1YDY","recordType":"advisory","relationships":[{"destId":"CVE-2026-42298","type":"equal"},{"destId":"GHSA-v975-9h5p-xhm4","type":"equal"}]}]}}}
{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"state":"PUBLISHED","datePublished":"2026-04-28T17:07:21.578Z","dateUpdated":"2026-08-10T19:20:45.423Z","assignerShortName":"Postiz","vulnId":"GCVE-125-2026-04-M1S0","cveId":"CVE-2026-42346"},"containers":{"cna":{"providerMetadata":{"shortName":"Postiz","dateUpdated":"2026-08-10T19:20:45.423Z"},"title":"TOCTOU DNS rebinding bypasses all SSRF URL validation paths","descriptions":[{"lang":"en","value":"All SSRF protections added in v2.21.4–v2.21.6 share a fundamental TOCTOU (Time-of-Check-Time-of-Use) vulnerability: `isSafePublicHttpsUrl()` resolves DNS to validate the target IP, but subsequent `fetch()` calls resolve DNS independently. An attacker controlling a DNS server can exploit this gap via DNS rebinding to redirect requests to internal network addresses."}],"affected":[{"vendor":"gitroomhq","product":"postiz-app","packageName":"postiz-app","defaultStatus":"unaffected","versions":[{"version":"2.16.6","status":"affected","versionType":"custom","lessThan":"*"}],"repo":"https://github.com/gitroomhq/postiz-app"}],"references":[{"url":"https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-f7jj-p389-4w45","tags":["vendor-advisory"],"name":"GHSA"},{"url":"https://github.com/gitroomhq/postiz-app/commit/071143dcb01cdeb9d5d7019892f4c6ff7b19dbeb","tags":["patch"],"name":"071143d"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-918","cweId":"CWE-918","type":"CWE"}]}],"credits":[{"lang":"en","value":"Junghwan","type":"reporter"},{"lang":"en","value":"Enno Gelhaus","type":"coordinator"},{"lang":"en","value":"Nevo David","type":"remediation developer"}],"datePublic":"2026-04-28T17:07:21.578Z","solutions":[{"lang":"en","value":"Upgrade to vX.XX.XX or later."}],"exploits":[{"lang":"en","value":"Full-read access to the internal network."}],"impacts":[{"descriptions":[{"lang":"en","value":"Internal network scanning: An attacker can probe internal hosts and ports via timing differences in webhook delivery. Even though responses are not returned, reachability can be inferred."}]},{"descriptions":[{"lang":"en","value":"Blind interaction with internal services: The SSRF sends POST requests with attacker-influenced body content (serialized post data) to internal services. Services without authentication (e.g., internal APIs, caches, message queues) could be manipulated."}]},{"descriptions":[{"lang":"en","value":"Cloud metadata access: On cloud deployments (AWS, GCP, Azure), the instance metadata service at 169.254.169.254 may be reachable, potentially exposing IAM credentials or instance configuration. While the response is not reflected to the attacker, the POST request itself reaches the metadata service."}]},{"descriptions":[{"lang":"en","value":"Persistence: The malicious webhook URL is stored in the database and triggered on every post publication until deleted, creating a persistent SSRF primitive."}]}],"timeline":[{"time":"2026-04-16T03:12:00.000Z","lang":"en","value":"Postiz has received the report."},{"time":"2026-04-22T15:29:00.000Z","lang":"en","value":"Postiz has developed the fix."},{"time":"2026-04-22T16:00:00.000Z","lang":"en","value":"Postiz is awaiting a response from the reporter to test the fix developed by Postiz, as Postiz cannot fully reproduce / test the advisory due to the difficulty."}],"x_gcve":[{"vulnId":"GCVE-125-2026-04-M1S0","recordType":"advisory","relationships":[{"destId":"CVE-2026-42346","type":"equal"},{"destId":"GHSA-f7jj-p389-4w45","type":"equal"}]}]}}}
{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"state":"PUBLISHED","datePublished":"2026-04-27T19:42:35.183Z","dateUpdated":"2026-08-10T19:20:45.380Z","assignerShortName":"Postiz","vulnId":"GCVE-125-2026-T0E4W0","cveId":"CVE-2026-42556"},"containers":{"cna":{"providerMetadata":{"shortName":"Postiz","dateUpdated":"2026-08-10T19:20:45.380Z"},"title":"Postiz stored XSS in public preview page","descriptions":[{"lang":"en","value":"Any authenticated user who can create a post can store arbitrary HTML in post `content` by tampering their own save request and send the public preview link `/p/<postId>?share=true` to another user. The preview page renders that stored HTML with `dangerouslySetInnerHTML` on the main application origin."}],"affected":[{"vendor":"gitroomhq","product":"postiz-app","packageName":"postiz-app","defaultStatus":"unaffected","versions":[{"version":"2.21.6","status":"affected","versionType":"custom","lessThan":"2.21.7"}]}],"references":[{"url":"https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-hhxq-3wg7-4rj8","tags":["vendor-advisory"],"name":"GHSA"},{"url":"https://github.com/user-attachments/assets/10c09f33-acb6-47f2-be8c-7d874cd4c96e","tags":["technical-description"],"name":"Video PoC"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L","baseScore":8.9,"baseSeverity":"HIGH"}},{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N","baseScore":7.1,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-79","cweId":"CWE-79","type":"CWE"}]}],"credits":[{"lang":"en","value":"Leo Vu","type":"reporter"},{"lang":"en","value":"Enno Gelhaus","type":"coordinator"},{"lang":"en","value":"Nevo David","type":"remediation developer"}],"datePublic":"2026-04-27T19:42:35.183Z","workarounds":[{"lang":"en","value":"No reliable workaround exists prior to v2.21.7."}],"solutions":[{"lang":"en","value":"Upgrade to v2.21.7 or later."}],"exploits":[{"lang":"en","value":"Stored Cross-Site Scripting (XSS) that allows any authenticated user to persistently compromise other users by using the post preview feature."}],"impacts":[{"descriptions":[{"lang":"en","value":"Through clicking the upload link, the attacker can invite himself as an admin to the team, gaining full admin permissions."}]},{"descriptions":[{"lang":"en","value":"Fully removing all posts & integrations of the team."}]},{"descriptions":[{"lang":"en","value":"Gaining the API token of the victim, so persistent access can be ensured."}]},{"descriptions":[{"lang":"en","value":"Gaining full API access, while impersonating the victim."}]}],"timeline":[{"time":"2026-04-20T13:27:00.000Z","lang":"en","value":"Postiz has received the advisory."},{"time":"2026-04-22T18:54:00.000Z","lang":"en","value":"Postiz has acknowledged & verified the advisory."},{"time":"2026-04-27T08:02:00.000Z","lang":"en","value":"Postiz has developed a fix."},{"time":"2026-04-27T19:34:00.000Z","lang":"en","value":"Postiz has verified the fix, created the release and released the advisory."}],"x_gcve":[{"vulnId":"GCVE-125-2026-T0E4W0","recordType":"advisory","relationships":[{"destId":"CVE-2026-42556","type":"equal"},{"destId":"GHSA-hhxq-3wg7-4rj8","type":"equal"}]}]}}}
{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"state":"PUBLISHED","datePublished":"2026-05-22T18:28:01.246Z","dateUpdated":"2026-08-10T19:20:45.478Z","assignerShortName":"Postiz","vulnId":"GCVE-125-2026-2CAQ96","cveId":"CVE-2026-48781"},"containers":{"cna":{"providerMetadata":{"shortName":"Postiz","dateUpdated":"2026-08-10T19:20:45.478Z"},"title":"SUPERADMIN takeover via Skool-provider JWT forgery","descriptions":[{"lang":"en","value":"Postiz's Skool integration callback signed an attacker-controlled JSON blob into a session-shape JWT using the application's `JWT_SECRET`, and the auth middleware trusted every claim in that JWT without re-resolving the user from the database. Any authenticated Postiz user could forge a SUPERADMIN session and impersonate arbitrary organizations."}],"affected":[{"vendor":"gitroomhq","product":"postiz-app","packageName":"postiz-app","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"custom","lessThan":"2.21.8"}],"repo":"https://github.com/gitroomhq/postiz-app"}],"references":[{"url":"https://github.com/gitroomhq/postiz-app/commit/23696d2973510ae1f3f48bfa41a6bfbbf9827b05","tags":["patch"],"name":"23696d2"},{"url":"https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.8","tags":["release-notes"],"name":"v2.21.8"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL"}},{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","baseScore":8.7,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-302","cweId":"CWE-302","type":"CWE"},{"lang":"en","description":"CWE-345","cweId":"CWE-345","type":"CWE"},{"lang":"en","description":"CWE-863","cweId":"CWE-863","type":"CWE"}]}],"credits":[{"lang":"en","value":"Nedum","type":"reporter"},{"lang":"en","value":"Enno Gelhaus","type":"coordinator"},{"lang":"en","value":"Nevo David","type":"remediation developer"}],"datePublic":"2026-05-22T18:28:01.246Z","dateAssigned":"2026-05-22T21:00:00.000Z","workarounds":[{"lang":"en","value":"No workaround is currently known, other than upgrading to v2.21.8."}],"solutions":[{"lang":"en","value":"The only solution, currently known, is upgrading to v2.21.8."}],"impacts":[{"descriptions":[{"lang":"en","value":"Full Access to all parts of Postiz."}]},{"descriptions":[{"lang":"en","value":"Access to all users registered to that instance."}]},{"descriptions":[{"lang":"en","value":"Ability to post in the name of the victim's social media channels added to that Postiz instance."}]}],"timeline":[{"time":"2026-05-22T11:21:00.000Z","lang":"en","value":"Postiz has received the report of the advisory."},{"time":"2026-05-22T12:00:00.000Z","lang":"en","value":"Postiz has verified the vulnerability."},{"time":"2026-05-22T12:16:00.000Z","lang":"en","value":"Postiz has developed and verified the fix."},{"time":"2026-05-22T18:30:00.000Z","lang":"en","value":"Postiz has released the developed fix, and published the advisory."},{"time":"2026-05-22T21:00:00.000Z","lang":"en","value":"GitHub has issued CVE-2026-48781 for this advisory."}],"x_gcve":[{"vulnId":"GCVE-125-2026-2CAQ96","recordType":"advisory","relationships":[{"destId":"CVE-2026-48781","type":"equal"}]}]}}}
{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"state":"PUBLISHED","datePublished":"2026-05-22T18:55:05.167Z","dateUpdated":"2026-08-10T19:20:45.548Z","assignerShortName":"Postiz","vulnId":"GCVE-125-2026-WWFR8X","cveId":"CVE-2026-48783"},"containers":{"cna":{"providerMetadata":{"shortName":"Postiz","dateUpdated":"2026-08-10T19:20:45.548Z"},"title":"Unauthenticated billing-enforcement bypass via /public/modify-subscription","descriptions":[{"lang":"en","value":"Postiz, an open-source social media scheduling platform, contained an unauthenticated endpoint that accepted a signed token and applied subscription-enforcement side effects to the organization referenced in that token's claims, without verifying the token's intended purpose.\n\nThe endpoint could not change the persisted subscription tier, but it did execute enforcement-related side effects on the caller's own organization, including adjusting team-member enablement state, disabling integrations exceeding the asserted plan's limits, and resetting the scheduled-post cron when the asserted plan was the free tier. Impact is limited to the attacker's own organization and cannot be redirected at other tenants through this endpoint."}],"affected":[{"vendor":"gitroomhq","product":"postiz-app","packageName":"postiz-app","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"custom","lessThan":"2.21.8"}],"repo":"https://github.com/gitroomhq/postiz-app"}],"references":[{"url":"https://github.com/gitroomhq/postiz-app/commit/23696d2973510ae1f3f48bfa41a6bfbbf9827b05","tags":["patch"],"name":"23696d2"},{"url":"https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.8","tags":["release-notes"],"name":"v2.21.8"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":4.8,"baseSeverity":"MEDIUM"}},{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","baseScore":4.4,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-862","cweId":"CWE-862","type":"CWE"},{"lang":"en","description":"CWE-345","cweId":"CWE-345","type":"CWE"},{"lang":"en","description":"CWE-639","cweId":"CWE-639","type":"CWE"},{"lang":"en","description":"CWE-749","cweId":"CWE-749","type":"CWE"}]}],"credits":[{"lang":"en","value":"Nedum","type":"reporter"},{"lang":"en","value":"Enno Gelhaus","type":"coordinator"},{"lang":"en","value":"Nevo David","type":"remediation developer"}],"datePublic":"2026-05-22T18:55:05.167Z","dateAssigned":"2026-05-22T21:01:00.000Z","workarounds":[{"lang":"en","value":"No workaround is currently known, other than upgrading to v2.21.8."}],"solutions":[{"lang":"en","value":"Currently no solution, other than upgrading to v2.21.8, is known."}],"configurations":[{"lang":"en","value":"Stripe has to be configured and used within the instance, for this vulnerability to apply."}],"impacts":[{"descriptions":[{"lang":"en","value":"The attack gains access to all billing plans within their organization, without providing any payment."}]}],"timeline":[{"time":"2026-05-22T11:21:00.000Z","lang":"en","value":"Postiz has received the advisory."},{"time":"2026-05-22T12:00:00.000Z","lang":"en","value":"Postiz has verified the vulnerability."},{"time":"2026-05-22T12:16:00.000Z","lang":"en","value":"Postiz has developed and verified the fix."},{"time":"2026-05-22T18:30:00.000Z","lang":"en","value":"Postiz has released the developed fix, and published the advisory."},{"time":"2026-05-22T21:01:00.000Z","lang":"en","value":"GitHub has issued CVE-2026-48783 for this advisory."}],"x_gcve":[{"vulnId":"GCVE-125-2026-WWFR8X","recordType":"advisory","relationships":[{"destId":"CVE-2026-48783","type":"equal"}]}]}}}
{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"state":"PUBLISHED","datePublished":"2026-05-23T12:23:18.968Z","dateUpdated":"2026-08-10T19:20:45.612Z","assignerShortName":"Postiz","vulnId":"GCVE-125-2026-Q3TCPK","cveId":"CVE-2026-48799"},"containers":{"cna":{"providerMetadata":{"shortName":"Postiz","dateUpdated":"2026-08-10T19:20:45.612Z"},"title":" Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook","descriptions":[{"lang":"en","value":"Postiz exposes a cryptocurrency payment IPN (Instant Payment Notification) handler that fails to verify the authenticity of incoming callbacks against the payment provider's shared secret. The endpoint accepts requests authenticated only by a token signed with an internal application key, which any platform user can obtain. Compounding this, the handler reads the target subscription identifier from the untrusted request body rather than from the verified token, allowing a caller to specify an arbitrary organization as the upgrade target.\n\nA remote attacker with a low-privileged account can therefore cause the application to persist a lifetime PRO subscription entitlement against any organization of their choosing, without any payment being made or any signal of compromise reaching the legitimate payment provider. The vulnerability primarily impacts the integrity of subscription and billing state and results in revenue loss for the operator. It does not disclose user data or affect service availability."}],"affected":[{"vendor":"gitroomhq","product":"postiz-app","packageName":"postiz-app","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"custom","lessThan":"2.21.8"}],"repo":"https://github.com/gitroomhq/postiz-app"}],"references":[{"url":"https://github.com/gitroomhq/postiz-app/commit/23696d2973510ae1f3f48bfa41a6bfbbf9827b05","tags":["related"],"name":"23696d2"},{"url":"https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.8","tags":["related"],"name":"v2.21.8"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","baseScore":7.7,"baseSeverity":"HIGH"}},{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","baseScore":4.8,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-345","cweId":"CWE-345","type":"CWE"},{"lang":"en","description":"CWE-639","cweId":"CWE-639","type":"CWE"}]}],"credits":[{"lang":"en","value":"Nedum","type":"reporter"},{"lang":"en","value":"Enno Gelhaus","type":"coordinator"},{"lang":"en","value":"Nevo David","type":"remediation developer"}],"datePublic":"2026-05-23T12:23:18.968Z","workarounds":[{"lang":"en","value":"No workaround is currently known, other than upgrading to v2.21.8."}],"solutions":[{"lang":"en","value":"Currently no solution, other than upgrading to v2.21.8, is known."}],"impacts":[{"descriptions":[{"lang":"en","value":"The attacker gains lifetime PRO access."}]}],"timeline":[{"time":"2026-05-22T11:21:00.000Z","lang":"en","value":"Postiz has received the advisory."},{"time":"2026-05-22T12:00:00.000Z","lang":"en","value":"Postiz has verified the vulnerability."},{"time":"2026-05-22T12:16:00.000Z","lang":"en","value":"Postiz has developed and verified the fix."},{"time":"2026-05-22T18:30:00.000Z","lang":"en","value":"Postiz has released the developed fix."},{"time":"2026-05-23T12:25:00.000Z","lang":"en","value":"Postiz has released the advisory."}],"x_gcve":[{"vulnId":"GCVE-125-2026-Q3TCPK","recordType":"advisory","relationships":[{"destId":"CVE-2026-48799","type":"equal"}]}]}}}
{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"state":"PUBLISHED","datePublished":"2026-06-22T13:46:51.287Z","dateUpdated":"2026-08-10T19:20:45.679Z","assignerShortName":"Postiz","vulnId":"GCVE-125-2026-NWZN9J","cveId":"CVE-2026-19127"},"containers":{"cna":{"providerMetadata":{"shortName":"Postiz","dateUpdated":"2026-08-10T19:20:45.679Z"},"title":"Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions","descriptions":[{"lang":"en","value":"An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows. By exploiting insufficient cryptographic validation or lack of server-side state verification on promotional/lifetime-deal (LTD) redemption codes, an unauthenticated attacker can forge valid redemption tokens or replay existing single-use codes to activate permanent, tier-highest paid subscriptions without a financial transaction."}],"affected":[{"vendor":"GitroomHQ","product":"postiz-app","packageName":"postiz-app","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"custom","lessThan":"2.21.10"}],"repo":"https://github.com/gitroomhq/postiz-app"}],"references":[{"url":"https://github.com/gitroomhq/postiz-app/commit/387d85dabe0223cd930714c19072a0aee58541ca","tags":["patch"],"name":"387d85d"},{"url":"https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.10","tags":["release-notes"],"name":"v2.21.10"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-345","cweId":"CWE-345","type":"CWE"}]}],"credits":[{"lang":"en","value":"Enno Gelhaus","type":"reporter"},{"lang":"en","value":"Enno Gelhaus","type":"coordinator"},{"lang":"en","value":"Nevo David","type":"remediation developer"}],"datePublic":"2026-06-22T13:46:51.287Z","dateAssigned":"2026-08-06T16:04:00.000Z","workarounds":[{"lang":"en","value":"No workaround other than upgrading to v2.21.10 is currently known."}],"solutions":[{"lang":"en","value":"No solution other than upgrading to v2.21.10 is currently known."}],"configurations":[{"lang":"en","value":"Stripe has to be configured for this to apply."}],"timeline":[{"time":"2026-06-21T18:00:00.000Z","lang":"en","value":"Postiz has discovered the vulnerability."},{"time":"2026-06-22T13:20:00.000Z","lang":"en","value":"Postiz has developed and verified the fix."},{"time":"2026-06-22T13:44:00.000Z","lang":"en","value":"Postiz has created the release and published the advisory."},{"time":"2026-08-06T16:04:00.000Z","lang":"en","value":"Postiz has assigned CVE-2026-19127 for this advisory."}],"x_gcve":[{"vulnId":"GCVE-125-2026-NWZN9J","recordType":"advisory","relationships":[{"destId":"CVE-2026-19127","type":"equal"}]}]}}}
{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"state":"PUBLISHED","datePublished":"2026-08-07T14:14:58.259Z","dateUpdated":"2026-08-10T18:40:14.471Z","assignerShortName":"Postiz","vulnId":"GCVE-125-2026-TH12B7","cveId":"CVE-2026-19264"},"containers":{"cna":{"providerMetadata":{"shortName":"Postiz","dateUpdated":"2026-08-10T18:40:14.471Z"},"title":"Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover","descriptions":[{"lang":"en","value":"Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw dot-segments are collapsed before routing, but URL-encoded separators survive route matching and are decoded only once they reach the handler, restoring the traversal at the filesystem call. An unauthenticated remote attacker can therefore read any file readable by the application process, including the process environment, which exposes the JWT signing secret, the database connection string, and connected provider and billing secrets. Because session tokens are signed with that secret and carry no expiry, this allows forging a non-expiring session as any user, including an administrator, without a password."}],"affected":[{"vendor":"gitroomhq","product":"postiz-app","packageName":"postiz-app","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"custom","lessThan":"2.22.1"}],"repo":"https://github.com/gitroomhq/postiz-app"}],"references":[{"url":"https://github.com/gitroomhq/postiz-app/commit/7936062","tags":["patch"],"name":"7936062"},{"url":"https://github.com/gitroomhq/postiz-app/releases/tag/v2.22.1","tags":["release-notes"],"name":"v2.22.1"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"}},{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","baseScore":9.3,"baseSeverity":"CRITICAL"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-22","cweId":"CWE-22","type":"CWE"}]}],"credits":[{"lang":"en","value":"KRITHIK BABU P","type":"reporter"},{"lang":"en","value":"Enno Gelhaus","type":"coordinator"},{"lang":"en","value":"Nevo David","type":"remediation developer"}],"datePublic":"2026-08-07T14:14:58.259Z","dateAssigned":"2026-08-07T14:13:00.000Z","configurations":[{"lang":"en","value":"Exploitation requires the environment variable STORAGE_PROVIDER to be set to 'local', which is the default value shipped in .env.example. On any other storage backend the /uploads route is rewritten to /404 and the vulnerable handler is unreachable."}],"timeline":[{"time":"2026-07-20T05:55:00.000Z","lang":"en","value":"Postiz has received the advisory."},{"time":"2026-07-20T07:44:00.000Z","lang":"en","value":"Postiz has acknowledged and verified the advisory."},{"time":"2026-07-20T12:18:00.000Z","lang":"en","value":"Postiz has published a fix for this advisory, and verified that it works."},{"time":"2026-08-07T14:13:00.000Z","lang":"en","value":"Postiz has issued CVE-2026-19264 for this advisory."}],"x_gcve":[{"vulnId":"GCVE-125-2026-TH12B7","recordType":"advisory","relationships":[{"destId":"CVE-2026-19264","type":"equal"},{"destId":"GHSA-4hgh-5rhf-4qpm","type":"equal"}]}]}}}
{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"state":"RESERVED","datePublished":"2026-08-15T10:43:29.895Z","dateUpdated":"2026-08-15T10:46:23.610Z","assignerShortName":"Postiz","vulnId":"GCVE-125-2026-G1CT26"},"containers":{"cna":{"providerMetadata":{"shortName":"Postiz","dateUpdated":"2026-08-15T10:46:23.610Z"},"title":"DMARC not enabled for postiz.com","descriptions":[{"lang":"en","value":"Postiz is an open-source social media scheduler. This advisory is exclusively for the Postiz Cloud environment.\nThe DMARC record of 'postiz.com' has been set to 'none', resulting it to be disabled. This would allow forgery or our email's, with no Spam-Filter blocking it on the client-side."}],"affected":[{"vendor":"GitroomHQ","product":"postiz-cloud","packageName":"postiz-cloud","defaultStatus":"affected","versions":[{"version":"0","status":"affected","versionType":"semver","lessThan":"0.1"}]}],"references":[{"url":"https://mxtoolbox.com/SuperTool.aspx?action=dmarc%3apostiz.com&run=toolpage","tags":["related"],"name":"DMARC of Postiz"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-290","cweId":"CWE-290","type":"CWE"}]}],"credits":[{"lang":"en","value":"Muhammad Waqas","type":"reporter"},{"lang":"en","value":"Enno Gelhaus","type":"coordinator"},{"lang":"en","value":"Nevo David","type":"remediation developer"}],"datePublic":"2026-08-15T10:43:29.895Z","impacts":[{"descriptions":[{"lang":"en","value":"Anybody was able to send emails from any postiz.com E-Mail, resulting in loss of trust to Postiz."}]}],"x_gcve":[{"vulnId":"GCVE-125-2026-G1CT26","recordType":"advisory"}]}}}