Postiz · Disclosed

Postiz 2.25.3 fixes forged tokens and path traversal

Oct 23, 2026 · 1 min read

In self-hosted Postiz, any registered user could forge signed tokens and take over other users and organizations (CVE-2026-115933), and read server files via path traversal when the Discord provider was configured (CVE-2026-115932). Upgrade to 2.25.3.

By HIFY Radar newsroom Updated 10/26/2026 01:11 PM Get this every day →← Back to the feed 3 sources

HighVulnerabilityDisclosedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Two serious flaws in self-hosted Postiz (a social media scheduling tool) were disclosed and fixed in version 2.25.3, released October 24, 2026. Any registered user could forge signed tokens and take over other users' accounts and organizations, and could read server files such as the JWT key and provider secrets, according to GAdvisory.

Why it matters

The token flaw allows full takeover of other customers' accounts and organizations. The file read exposes server secrets, including the JWT signing key, the database address, and provider credentials. Self-registration is open by default, so anyone can create an account and attack.

What to do

Upgrade postiz-app to version 2.25.3 immediately, as the project itself recommends. Meanwhile, set DISABLE_REGISTRATION=true and, if you do not use Discord, leave that provider's credentials empty. After upgrading, rotate any secrets that could have been read.

For the technical team

CVE: CVE-2026-115933, CVE-2026-115932
Affected: Postiz (gitroomhq/postiz-app), self-hosted · postiz-app 2.15.0 to before 2.25.3 (CVE-2026-115933); postiz-app 2.23.0 to before 2.25.3 (CVE-2026-115932, main route with the Discord provider).
Exploitation: No reports of in-the-wild exploitation in the sources. GAdvisory reports end-to-end exploitation demonstrated against unmodified backend and orchestrator builds at commit 3a7d28b7ad96 using a self-registered account: a file outside the upload directory arrived byte for byte as an attachment in the attacker's Discord channel. The validation-time and stored media routes were also exercised. Anthropic delivered a working PoC to Postiz on 10/23/2026.
Fix: Upgrade to postiz-app 2.25.3 (patch 12db9bd, release dated 10/24/2026). Partial mitigations that do not close the issue: set DISABLE_REGISTRATION=true; if the Discord provider is not needed, leave DISCORD_CLIENT_ID, DISCORD_CLIENT_SECRET and DISCORD_BOT_TOKEN_ID unset (removes the main route only; the other routes remain).
Vector: Two flaws in self-hosted Postiz. CVE-2026-115933: any registered user can forge signed tokens and take over other users' accounts and organizations. CVE-2026-115932 (CVSS v3 9.6, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, CWE-22 and CWE-74): path traversal in post media; a path that is not a web address is treated as a file on disk with no check that it lies inside the upload directory; the publishing worker reads the file and sends it as an attachment to an attacker-controlled Discord server. The main route requires the Discord provider configured (DISCORD_CLIENT_ID, DISCORD_CLIENT_SECRET and DISCORD_BOT_TOKEN_ID set) and only an ordinary account; self-registration is open by default.
More details: Additional CVE-2026-115932 routes (GAdvisory): with a Dribbble, TikTok or Pinterest provider configured, check whether a path exists (file or directory) and exhaust the backend's memory with a single request pointing at a device file, stopping the backend for all organizations until killed; on instances using local storage with an empty cloud bucket URL, the same file read works without needing a WordPress site. The shipped container runs the worker as root, so every file root can read is exposed. Files within reach include the JWT signing secret, the database address, provider client secrets, the environment file, mounted secret files, application logs, and the worker's process environment. Credits: Anthropic, PBC (finder), Enno Gelhaus (coordinator), Nevo David (remediation developer). Timeline: disclosed 10/23/2026 17:45; reproduced 18:00; fix pushed and verified 10/24 12:26; release and advisory published 10/24 14:18.