Skip to content
GAdvisory
PSA-2026-P8W1J0CVE-2026-94455September 22, 2026
7.1 High

Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key

The /enterprise/create-user endpoint is not covered by authentication middleware and accepts any token signed with the instance JWT secret. Ordinary login tokens are signed with that same secret and carry no purpose claim, so any registered user can replay their own session token to create a new organisation with a permanent top-tier subscription and receive its API key in the response. Only deployments with billing enabled are affected.

Affected (1)

  • GitroomHQpostiz-app
    • ≥ 0Fixed in 2.4.0

Mitigations

Workarounds

  • Block POST /enterprise/create-user, and preferably all of /enterprise/*, at your reverse proxy, ingress or WAF. If you do not use Postiz's enterprise or reseller provisioning integration, nothing legitimate calls these routes, so blocking them has no user-visible effect.
  • Set DISABLE_REGISTRATION=true. The caller needs an ordinary account on your instance to obtain a usable token, so closing self-registration limits exposure to people who already have one. This reduces reach, it does not close the issue.

Exploits

  • 1. Register an ordinary account on the target instance and capture that account's own login JWT.
  • 2. POST /api/enterprise/create-user with body {"params": "<that login JWT, verbatim>"}.
  • 3. The response is 200 with {"id": "<new organisation id>", "apiKey": "<key>"}.
  • 4. Confirm the new organisation carries subscriptionTier=ULTIMATE, isLifetime=true and totalChannels=1000000, and that it is distinct from the caller's own registration organisation.
  • 5. Send the returned apiKey as the Authorization header against a public API endpoint and confirm 200, versus 401 for an invalid key.
  • Controls: an absent token, a malformed token, and a token with a valid-looking payload but a wrong signature all fail with no organisation created, confirming signature verification is the only gate.

Configurations

  • You are affected if your deployment has billing enabled, that is if STRIPE_PUBLISHABLE_KEY or STRIPE_SECRET_KEY is set. This covers the hosted Postiz service and any self-hoster running Postiz commercially.
  • You are not meaningfully affected if you run a default self-hosted instance with no Stripe configuration. In that mode Postiz does not enforce subscription entitlements at all, so an organisation created through this endpoint holds no privileges your users do not already have.
  • Exposure is wider if self-registration is open, that is if DISABLE_REGISTRATION is unset or not set to 'true', because anyone on the internet can then obtain the account needed. With registration closed, the issue is reachable only by people who already hold an account on your instance.

Overview

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes.

The endpoint's only check is that the request body carries a token bearing a valid signature from the instance secret. It does not check what that token was issued for. Login tokens are signed with the same secret and carry no purpose, audience or expiry claim, so an ordinary user's own session token satisfies the check.

Presented with such a token, the endpoint creates a new organisation holding the highest subscription tier, flagged as lifetime and with a channel allowance far above any sold plan, creates an organisation-owner account alongside it, and returns the new organisation's API key in the response body. That key is immediately valid against the public API.

Severity

CVSS v3
7.1 High
7.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
Low

Weaknesses (4)

References (3)

Credits (3)

  • Santosh Kumar Puppala
    Reporter · @Santoshkumarpuppala
  • Enno Gelhaus
    Coordinator · @egelhaus
  • Nevo David
    Remediation developer · @nevo-david

Context

Impacts

  • Billing-integrity bypass. Any registered user can provision an organisation at the highest subscription tier, flagged as lifetime, with a channel allowance of 1,000,000 against the 100 provisioned for a genuine paying customer at that same tier.

  • Recurring unmetered resource consumption. The per-organisation AI allowance (500 image generations, 60 video generations, 600 clipping minutes) refills on a rolling monthly window, and the lifetime flag exempts the organisation from subscription reconciliation, so each provisioned organisation is an indefinite draw on the operator's model and GPU budget rather than a one-off.

  • Disclosure of a usable organisation API key in the response body, valid immediately against the public API without an interactive session.

  • No confidentiality impact on existing tenants. The provisioned organisation is empty; no other organisation's channels, posts, media or account data become reachable.

Timeline

  1. 09/21/2026 13:34

    Postiz has received and acknowledged the report.

  2. 09/21/2026 20:15

    Postiz has verified the report.

  3. 09/22/2026 04:32

    Postiz has developed and verified the patch.

  4. 09/22/2026 14:17

    Postiz has released the patch notes and published the advisory.

© 2026 Gelhaus Solutions