Published advisories

Channel tokens and organization API key exposed in API responses

Two authenticated Postiz endpoints returned the full database row instead of the fields the client needs. Deleting a channel through the public API returned that channel's platform access and refresh tokens to the calling OAuth app, and GET /user/organizations returned the organization API key to every member, although it is meant to be visible to admins only.

Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key

The /enterprise/create-user endpoint is not covered by authentication middleware and accepts any token signed with the instance JWT secret. Ordinary login tokens are signed with that same secret and carry no purpose claim, so any registered user can replay their own session token to create a new organisation with a permanent top-tier subscription and receive its API key in the response. Only deployments with billing enabled are affected.

Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys

Postiz generates OAuth access tokens, authorization codes, OAuth client secrets and per-organization API keys with a helper that draws every character from Math.random(), a non-cryptographic generator. Its output is directly observable, in bulk, from an endpoint that requires no authentication. Recovering the generator's internal state from that output is a linear-algebra problem, after which credentials minted for other organizations follow deterministically.

Cloud broker issues and replaces application credentials without authentication

The application registration endpoint on the cloud broker verified no credential before issuing one. A caller naming an existing application instance received a valid credential for it, and the stored credential was replaced. Rotation did not remediate the issue.

Failed second-factor codes are not counted toward account lockout

A failed password attempt counted toward an account lockout; a failed one-time code did not, on either sign in or re-authentication, and no rate limiting applied. An attacker holding a valid password could guess the second factor without limit.

Privileged administrative operations did not declare required roles

Role requirements were declared per operation and most privileged operations declared none, which admitted any role. The lowest-privilege role, assigned by default when an account is created without one, could change customer licensing and publish signed software.

DMARC not enabled for postiz.com

Postiz has not enabled DMARC on their primary domain, resulting to email forgery.

Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions

Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook

Unauthenticated billing-enforcement bypass via /public/modify-subscription

SUPERADMIN takeover via Skool-provider JWT forgery

Attackers can exploit the skool-provider JWT sign process to generate a JWT token with isSuperAdmin: true

CRLF injection in email subject via project name

Project name was interpolated into outbound email subjects without rejecting CR/LF, so an admin could inject extra headers (Bcc, etc.) via the project settings form. Fixed by rejecting line breaks in the project name validator.

Missing browser security response headers

The dashboard shipped without CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, or HSTS, leaving it exposed to clickjacking, MIME-sniffing, and missing the standard defense-in-depth layer against same-origin XSS. Fixed by adding the standard security header set in next.config.ts.

Unbounded request body on webhook and CI endpoints

The GitHub webhook and CI check-pr API routes read the full request body before any validation. Anyone able to reach the endpoints could post a multi-GB body and exhaust process memory. Fixed by adding a streaming size cap (1MB and 2MB respectively) that returns 413 before signature or JWT verification.

SSRF in outbound project webhook delivery

A project admin could register an outbound webhook URL that resolved to internal addresses (cloud metadata, loopback, RFC1918), and the response body was persisted and exposed in the project settings UI. Fixed by validating URLs against a private-address blocklist before each delivery.

Bearer tokens and webhook signatures could leak to Sentry

Sentry capture ran without a beforeSend filter, so caught errors carrying request metadata (Authorization headers, x-hub-signature-256, GitHub installation tokens, JWT bodies) could be serialized into Sentry events. Fixed by adding a recursive scrubber on both server and edge runtimes.

TOCTOU DNS rebinding bypasses all SSRF URL validation paths

TOCTOU DNS rebinding bypasses all SSRF URL validation paths

Postiz stored XSS in public preview page

Postiz stored XSS in public preview page

Weak default fallback secrets allow JWT and CSRF token forgery in cobc-events

cobc-events <1.0.1 fell back to hard-coded development secrets when JWT_SECRET / SESSION_SECRET were unset, allowing forgery of session JWTs and CSRF HMAC tokens.

Non-constant-time CSRF token comparison and lax hex parsing in cobc-events

The CSRF middleware in cobc-events <1.0.1 compared the cookie nonce with `!==` before the timing-safe HMAC check and accepted malformed hex input, leaking timing data and weakening token verification.

Permissive CORS configuration allows credentialed cross-origin requests in cobc-events

cobc-events <1.0.1 enabled CORS with the default `cors()` configuration, accepting any `Origin`. Combined with the JWT cookie, this allowed cross-origin sites to issue authenticated requests against the API.

Missing HSTS and incomplete CSP directives in cobc-events

cobc-events <1.0.1 did not set Strict-Transport-Security and was missing key Content-Security-Policy directives (`frame-ancestors`, `object-src`, `base-uri`, `form-action`), enabling downgrade and clickjacking attacks.

IDOR on /api/loa/user/:userId and /api/strikes/user/:userId in cobc-events

Endpoints returning another user's LoA/strikes only required `view_own_*` permission and did not enforce that the caller owned the path parameter, allowing any authenticated host to read other users' history.

Permissive file upload filter accepts SVG enabling stored XSS in cobc-events

The multer fileFilter in cobc-events <1.0.1 used the regex `^(image|video|application/pdf)`, which matches `image/svg+xml` and any `video/*` MIME type. SVG uploads enable stored XSS when later served from the application origin.

Discord bot /config and /setchannel commands lacked authorization in cobc-events

The `/config` and `/setchannel` slash commands in cobc-events <1.0.1 had no permission check, letting any guild member toggle logging features or reroute strike/event/LoA log channels.

Unbounded pagination limits enable resource exhaustion in cobc-events

Several REST endpoints accepted a client-controlled `limit` query parameter with no upper bound, allowing authenticated users to request arbitrarily large result sets and exhaust database / memory.

Strike status filter accepted arbitrary strings in cobc-events

`/api/strikes` previously accepted any comma-separated string in `?status=` and forwarded it to the service layer without validation against the StrikeStatus enum.

Cache invalidation used blocking Redis KEYS command in cobc-events

`CacheService.invalidatePattern` called `redis.keys(pattern)`, which blocks the Redis instance. On large keyspaces this could stall the entire Redis server and create a denial-of-service condition.

Stored XSS via manual HTML escaping in events log-outcome view in cobc-events

The `log-outcome.ejs` template used the unescaped `<%-` output tag with hand-rolled HTML escaping that did not cover all XSS vectors, allowing stored XSS via `event.notes`.

Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev

Server-Side Request Forgery via Redirect Bypass in /api/public/stream

Server-Side Request Forgery via Redirect Bypass in /api/public/stream

Unrestricted File Upload via MIME Type Spoofing Leads to Stored XSS

Unrestricted File Upload via MIME Type Spoofing Leads to Stored XSS

SSRF via Webhook Creation Endpoint Missing URL Safety Validation

SSRF via Webhook Creation Endpoint Missing URL Safety Validation

SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata

SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata

Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check

Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check

High-Severity SSRF in Postiz App

High-Severity SSRF in Postiz App

Multiple SSRF Vectors - Webhooks, RSS Feed, URL Loader (CWE-918)

Multiple SSRF Vectors - Webhooks, RSS Feed, URL Loader (CWE-918)

Header mutation in middleware facilitates SSRF

Header mutation in middleware facilitates SSRF