Skip to content
feed: live
0dayNews
CVE Record
[ CRITICAL ]CVE-2026-115933

Token type confusion in Postiz-app token signing allows privilege escalation

Postiz-app signs all token types with a shared secret and no type marker, letting authenticated users forge valid session and admin-escalation tokens.

cat cve-2026-115933.json
Vendor
GitroomHQ
Product
Postiz-app
CVSS
9.9
EPSS (exploit probability)
0.2%
Status
patched
Published
Source
https://gadvisory.org/advisories/PSA-2026-YT2HMH

Is CVE-2026-115933 being exploited?

Not on any exploited-vulnerability catalog we track. CVE-2026-115933 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-25 snapshot. That can change quickly; check the write-up below for the latest reporting.

FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.2% (scored October 25, 2026).

Catalog snapshot 2026-10-25. Full cross-catalog view: /kev-comparison

CVE-2026-115933 timeline

  1. Published to NVD
  2. Patch availablesame day as NVD
    Fixed in Postiz-app 2.25.3
  3. Vendor advisorysame day as NVD
    Advisory PSA-2026-YT2HMH published by GitroomHQ
  4. First 0dayNews coverage+1d

Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON

Postiz-app signs session tokens, organization invitation tokens, and password-reset tokens with a single shared HMAC secret and no type marker in the payload. The /integrations/extension-refresh OAuth endpoint, used to refresh credentials for the Postiz browser extension, lets the server sign arbitrary JSON claims as part of the Skool integration flow.

A registered user who connects their Skool account can supply crafted claims to that endpoint and receive back a token signed by the same secret that protects logins and password resets. That forged token is accepted as a legitimate session, invitation, or password-reset token anywhere Postiz validates it, enabling full account takeover or organization administrator escalation.

Affected versions: Postiz-app 2.15.0 and later. Fixed in 2.25.3, released October 24, 2026.

Source: PSA-2026-YT2HMH (gadvisory.org)

Related coverage
~/articles/2026-10-25-postiz-cve-2026-115933-token-confusion-admin
cloud

Postiz Patches Critical Token Confusion Bug, CVSS 9.9

Postiz-app 2.15.0-2.25.2 shares one signing secret for all token types with no type marker. Patch to 2.25.3 immediately. No active exploitation reported.

read →