Postiz Patches Critical Token Confusion Bug, CVSS 9.9

Postiz-app, the open-source social media management platform, shipped a critical patch on October 24, 2026. If you’re running any self-hosted or cloud-managed Postiz instance at version 2.15.0 or later, upgrade to 2.25.3 before anything else today.

What’s broken

The root cause is a token signing architecture that treats session tokens, organization invitation tokens, and password-reset tokens as interchangeable. All three are signed with the same HMAC secret and none include a field indicating what type of token they are.

Postiz’s /integrations/extension-refresh endpoint handles credential refresh for the browser extension via the Skool integration. As part of that OAuth flow, the server signs arbitrary JSON claims supplied by the connecting user. A registered user who links a Skool account can craft those claims to produce a token containing whatever payload they want, signed by the same key that validates logins and password resets.

The result: that forged token is accepted by any Postiz validation path. An attacker can use it to take over another user’s session, trigger a password reset on an account they don’t own, or accept an org invitation in a way that grants them administrator role in a target organization.

According to advisory PSA-2026-YT2HMH, Anthropic’s security team disclosed the flaw with a working proof-of-concept. Postiz confirmed reproduction within 15 minutes. CVSS is 9.9 Critical.

Timeline

Disclosure and patch happened fast. Anthropic reported on October 23, 2026 at 17:45 UTC. The Postiz team confirmed and began remediation within 15 minutes, and had 2.25.3 published by October 24 at 14:18 UTC: roughly 20 hours from disclosure to fixed release. There is no reported active exploitation as of this writing.

What to do

Upgrade to 2.25.3. The fix introduces type claims into token payloads so that a session token cannot be reused as a password-reset or invitation token even if both are validly signed.

If you cannot patch immediately, disabling the Skool integration blocks the specific exploitation path described in the advisory, though the underlying token architecture remains vulnerable until you upgrade.

After patching, review logs for unexpected activity on /integrations/extension-refresh and audit any organization role changes between October 15 and October 24. Versions before 2.15.0 are not confirmed affected.

Self-hosted operators should treat this as urgent: the exploit requires only a valid registered account, not any elevated privilege, and the affected endpoint is reachable by default on standard Postiz deployments.

---

For the CVE record and full timeline, see CVE-2026-115933.

Related recent patches on the web application security beat: Next.js Out-of-Band Update Fixes Two Critical RCEs, Brotli Decoder Flaw Hits Node.js, Bun, Python: RCE Confirmed, Docker Hub Fixes Critical Image Impersonation Flaw.