Postiz App

Forged signed tokens let any registered user take over other users and organizations

A registered Postiz user who connects their own Skool account can get the server to sign data of their choosing with the secret that protects every login, invitation and password reset token. The resulting token lets them sign in as other users, reset their passwords or join any other organization as super administrator.

Path traversal in post media lets any registered user read server files

A registered Postiz user can make the publishing worker open files outside the upload directory and deliver their contents to a Discord server the user controls. Any file the worker can read can be taken, including files that hold the secret that signs login sessions.

Arbitrary file read and backend crash through unrestricted provider method calls

A registered Postiz user can make the backend run internal helper functions that were never meant to be reachable from the web interface. This lets them read any file the backend process can read, including its environment and the secret that signs login sessions, and crash the backend with a single request.

Channel tokens and organization API key exposed in API responses

Two authenticated Postiz endpoints returned the full database row instead of the fields the client needs. Deleting a channel through the public API returned that channel's platform access and refresh tokens to the calling OAuth app, and GET /user/organizations returned the organization API key to every member, although it is meant to be visible to admins only.

Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key

The /enterprise/create-user endpoint is not covered by authentication middleware and accepts any token signed with the instance JWT secret. Ordinary login tokens are signed with that same secret and carry no purpose claim, so any registered user can replay their own session token to create a new organisation with a permanent top-tier subscription and receive its API key in the response. Only deployments with billing enabled are affected.

Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys

Postiz generates OAuth access tokens, authorization codes, OAuth client secrets and per-organization API keys with a helper that draws every character from Math.random(), a non-cryptographic generator. Its output is directly observable, in bulk, from an endpoint that requires no authentication. Recovering the generator's internal state from that output is a linear-algebra problem, after which credentials minted for other organizations follow deterministically.

Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions

Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook

Unauthenticated billing-enforcement bypass via /public/modify-subscription

SUPERADMIN takeover via Skool-provider JWT forgery

Attackers can exploit the skool-provider JWT sign process to generate a JWT token with isSuperAdmin: true

TOCTOU DNS rebinding bypasses all SSRF URL validation paths

TOCTOU DNS rebinding bypasses all SSRF URL validation paths

Postiz stored XSS in public preview page

Postiz stored XSS in public preview page

Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev

Server-Side Request Forgery via Redirect Bypass in /api/public/stream

Server-Side Request Forgery via Redirect Bypass in /api/public/stream

Unrestricted File Upload via MIME Type Spoofing Leads to Stored XSS

Unrestricted File Upload via MIME Type Spoofing Leads to Stored XSS

SSRF via Webhook Creation Endpoint Missing URL Safety Validation

SSRF via Webhook Creation Endpoint Missing URL Safety Validation

SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata

SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata

Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check

Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check

High-Severity SSRF in Postiz App

High-Severity SSRF in Postiz App

Multiple SSRF Vectors - Webhooks, RSS Feed, URL Loader (CWE-918)

Multiple SSRF Vectors - Webhooks, RSS Feed, URL Loader (CWE-918)

Header mutation in middleware facilitates SSRF

Header mutation in middleware facilitates SSRF