Skip to content
GAdvisory
PSA-2026-YT2HMHCVE-2026-115933GCVE-125-2026-YT2HMHOctober 24, 2026
9.9 Critical

Forged signed tokens let any registered user take over other users and organizations

A registered Postiz user who connects their own Skool account can get the server to sign data of their choosing with the secret that protects every login, invitation and password reset token. The resulting token lets them sign in as other users, reset their passwords or join any other organization as super administrator.

Affected (1)

  • GitroomHQpostiz-app
    • ≥ 2.15.0Fixed in 2.25.3

Mitigations

Workarounds

  • If you do not use channels that rely on the Postiz browser extension, block POST /integrations/extension-refresh at your reverse proxy. This removes the main signing route; the team invitation route remains.
  • Set DISABLE_REGISTRATION=true. The attacker needs an ordinary account, so closing self-registration limits exposure to people who already hold one. This reduces reach, it does not close the issue.

Exploits

  • Exploitation was demonstrated end to end against an unmodified backend build at commit 3a7d28b7ad96: a second self-registered user became super administrator of another user's organization and read its API key. Session, password reset, enterprise and subscription tokens obtained the same way were each accepted by their endpoints.

Configurations

  • The instance must be able to reach api2.skool.com, as any instance using the Skool provider can. No setting has to be changed.
  • With Stripe billing configured, the attacker's own plan must allow one channel and the target organization must not be on the STANDARD tier. The session and password reset tokens are not affected by these limits.
  • Self-registration is open unless DISABLE_REGISTRATION is set to true.

Overview

Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token.

A second, narrower route that creates team invitations signs extra fields from the request body in the same way.

Severity

CVSS v3
9.9 Critical
9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Weaknesses (3)

References (3)

Credits (3)

  • Anthropic, PBC
    Finder
  • Enno Gelhaus
    Coordinator · @egelhaus
  • Nevo David
    Remediation developer · @nevo-david

Context

Impacts

  • A registered user can obtain a validly signed token with claims of their choosing and use it as a login session for another user, without knowing any identifier of the victim when database filter objects are used as claims.

  • An attacker can join any other organization as super administrator, using an organization id that is exposed by any shared post preview link, read its API key and channel list and schedule posts through its connected social accounts.

  • An attacker can reset the password of a user whose id they know, and can obtain an organization with a lifetime top-tier subscription through the enterprise provisioning endpoint.

  • Forged tokens do not expire and cannot be told apart from genuine ones.

  • The narrower invitation route lets a user who may invite team members repeatedly stop the scheduled posts of a channel of another organization, and lift the channel limit of their own plan.

Timeline

  1. 10/23/2026 17:45

    Anthropic has disclosed a thorough report of this vulnerability including a working PoC to Postiz

  2. 10/23/2026 18:00

    Postiz has reproduced the vulnerability and is working on a fix

  3. 10/24/2026 13:27

    Postiz has pushed a fix for this vulnerability and verified it

  4. 10/24/2026 14:18

    Postiz has created a release and published the advisory

© 2026 Gelhaus Solutions