vulnerability

Postiz's One Signing Key Opened Four Doors

Postiz signs session, invitation, and password-reset tokens with one shared secret and no marker of what each token is for. A signed-in user could mint a validly signed token carrying any claims. Three critical CVEs, fixed in v2.25.3.

Glenn Fryklund

Glenn Fryklund

— 3 min read
Share
A single brass key before four closed doors, each a different color
Rendered with AI: a single brass key before four closed doors, each a different color. One shared signing key, four accepted token types.

Postiz signs four different kinds of token with the same secret, and it does not write down what each one is for. That single design choice is why a signed-in user can mint a token that Postiz will accept as a session, an organization invitation with a chosen role, a password reset, or an enterprise provisioning token. The flaw, plus two related routes, made up a three-CVE critical cluster that the vendor fixed in v2.25.3 on 2026-10-24.

Postiz is a self-hosted social-media management platform. You run it on your own infrastructure, and it connects to your social channels to schedule and publish posts. Versions 2.15.0 through 2.25.2 carry the cluster. All three CVEs are rated critical, with CVSS scores of 9.9, 9.9, and 9.6.

The core of the cluster is the token design. Postiz signs session, invitation, and password-reset tokens with one shared secret, and the token carries no marker of what it is for. A valid signature therefore proves only that Postiz signed it, not which purpose it claims. A browser-extension channel-refresh route signs data taken from the request itself and stores the result where the requesting user can read it back. A user can use that route to produce a validly signed token carrying any claims, and Postiz accepts it as a session, an organization invitation with a chosen role, a password reset, or an enterprise provisioning token. A second, narrower team-invitation route signs extra fields from the request body the same way. The enterprise-provisioning-token claim comes from the advisory's description and is not separately confirmed by a vendor statement.

The other two routes are narrower but land in the same place. CVE-2026-115931 lets a signed-in user ask the backend to run a function on one of their connected channels, a form of server-side function execution. CVE-2026-115932 means that when a post is published, a media path that is not a web address is treated as a file on the server, an open path to local file read. The public record describes both at a high level, and the exact trigger surface is not fully detailed in the advisory.

The trust model is the part that matters. Postiz runs on your own hardware, which is the appeal of self-hosted software. But the platform hands a signed-in, non-admin user a path to forge admin-level tokens and to trigger server-side functions on connected channels. Self-hosting the software does not remove the application's trust assumptions, and these three flaws show what happens when a user's signed-in state is trusted more than it should be in several places at once.

The deeper point is the class of bug, not just this product. A token's purpose is not bound into the token itself, so the signature cannot distinguish a session token from an invitation token. The fix (commit a5affe62, "fix: jwt bypass") addresses that, but the general lesson is that a signature proves authenticity, not intent. If the verifier does not check which purpose a token claims, one valid signature becomes a key that opens every door.

This is a fix-release disclosure, not an active-exploitation report. As of 2026-10-26 there is no CISA KEV listing and no confirmed in-the-wild exploitation, and the NVD records sit in Received or Deferred status. The v2.25.3 release notes explicitly address the GAD advisories PSA-2026-YT2HMH and PSA-2026-E9AHFV and recommend an immediate upgrade. If you run Postiz, move to 2.25.3.

Sources

This article was drafted with AI/LLM assistance and reviewed by a human before publication. All factual claims were checked against the public sources cited above. The feature image was generated with AI. See How we use AI for the full workflow.

Topics:

Read more