Advisories · Technology
GitroomHQ postiz-app.
Every CVE that names GitroomHQ postiz-app among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.9 CriticalCritical · CVSS 9+
Forged signed tokens let any registered user take over other users and organizations
- GitroomHQ postiz-app
- Authentication bypass
- Broken access control
- CVSS 9.6 CriticalCritical · CVSS 9+
Path traversal in post media lets any registered user read server files
- GitroomHQ postiz-app
- Path traversal
- Other injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Arbitrary file read and backend crash through unrestricted provider method calls
- GitroomHQ postiz-app
- Path traversal
- Code injection
- CVSS 5.3 Medium
Channel tokens and organization API key exposed in API responses
- GitroomHQ postiz-app
- Information disclosure
- CWE-213
- CVSS 7.1 High
Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key
- GitroomHQ postiz-app
- Authentication bypass
- Denial of service
- CVSS 9.1 CriticalCritical · CVSS 9+
Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys
- GitroomHQ postiz-app
- Weak cryptography or TLS
- CWE-341
- CVSS 9.3 CriticalCritical · CVSS 9+
Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover
- gitroomhq postiz-app
- Path traversal
- CVSS 6.5 Medium
Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions
- GitroomHQ postiz-app
- CWE-345
- CVSS 7.7 High
Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook
- gitroomhq postiz-app
- Broken access control
- CWE-345
- CVSS 4.8 Medium
Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription
- gitroomhq postiz-app
- Broken access control
- CWE-345
- CVSS 9.9 CriticalCritical · CVSS 9+
Postiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgery
- gitroomhq postiz-app
- Broken access control
- CWE-302
- CVSS 8.9 High
Postiz stored XSS in public preview page
- gitroomhq postiz-app
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Postiz: TOCTOU DNS rebinding bypasses all SSRF URL validation paths
- gitroomhq postiz-app
- Server-side request forgery (SSRF)
- CVSS 10.0 CriticalCritical · CVSS 9+
Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev
- gitroomhq postiz-app
- Code injection
- CVSS 8.9 High
Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS
- gitroomhq postiz-app
- Cross-site scripting (XSS)
- Unrestricted file upload
- CVSS 8.2 High
Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream
- gitroomhq postiz-app
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation
- gitroomhq postiz-app
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check
- gitroomhq postiz-app
- Server-side request forgery (SSRF)
- CVSS 8.3 High
Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata
- gitroomhq postiz-app
- Server-side request forgery (SSRF)
- CVSS 8.2 High
Postiz allows header mutation in middleware facilitates resulting in SSRF
- gitroomhq postiz-app
- Server-side request forgery (SSRF)