Skip to content
OpenAdvisories

Vendor

gitroomhq

20 known vulnerabilities.

Products

postiz-app 20
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.1
    CVE-2026-94455

    Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key

    An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authent…

    gitroomhq postiz-app
  • High 7.7
    CVE-2026-48799

    Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook

    Postiz is an AI social media scheduling tool. Prior to 2.21.8, Postiz fails to verify Nowpayments IPN callback authenticity against the payment provider shared secret and reads the target subscription identifier from the untrusted request body, allowing a low…

    gitroomhq postiz-app
  • High 8.9
    CVE-2026-42556

    Postiz stored XSS in public preview page

    Postiz is an AI social media scheduling tool. From version 2.21.6 to before version 2.21.7, any authenticated user who can create a post can store arbitrary HTML in post content by tampering their own save request and send the public preview link /p/<postId>?…

    gitroomhq postiz-app
  • High 8.9
    CVE-2026-40487 Public exploit

    Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS

    Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the `Content-Type` header. The uploade…

    gitroomhq postiz-app
  • High 8.2
    CVE-2026-40168

    Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream

    Postiz is an AI social media scheduling tool. Prior to 2.21.5, the /api/public/stream endpoint is vulnerable to SSRF. Although the application validates the initially supplied URL and blocks direct private/internal hosts, it does not re-validate the final des…

    gitroomhq postiz-app
  • High 8.6
    CVE-2026-34577

    Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check

    Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the GET /public/stream endpoint in PublicController accepts a user-supplied url query parameter and proxies the full HTTP response back to the caller. The only validation is url.endsWith('…

    gitroomhq postiz-app
  • High 8.3
    CVE-2026-34576

    Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata

    Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the POST /public/v1/upload-from-url endpoint accepts a user-supplied URL and fetches it server-side using axios.get() with no SSRF protections. The only validation is a file extension chec…

    gitroomhq postiz-app
  • High 8.2
    CVE-2025-53641

    Postiz allows header mutation in middleware facilitates resulting in SSRF

    Postiz is an AI social media scheduling tool. From 1.45.1 to 1.62.3, the Postiz frontend application allows an attacker to inject arbitrary HTTP headers into the middleware pipeline. This flaw enables a server-side request forgery (SSRF) condition, which can …

    gitroomhq postiz-app