CVE-2026-34576

Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the caller is not meant to receive: the public API's channel delete returns the channel's platform access token and refresh token, and GET /user/organizations returns each organization's API key to every member. Both endpoints require a valid session, API key or OAuth token and are scoped to the caller's own organization.

Postiz generates security-sensitive credentials using Math.random() instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8's deterministic xorshift128+ PRNG state. An unauthenticated OAuth dynamic client registration endpoint exposes freshly generated client credentials, giving attackers enough consecutive PRNG output to reconstruct that internal state and derive past and future values.

Postiz, an open-source social media scheduling tool, has a path traversal vulnerability in the route serving locally stored media. The route requires no authentication and does not normalize paths, allowing an unauthenticated attacker to read any file readable by the process, including environment variables with JWT secrets and database credentials.

Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, an attacker could exploit a vulnerability in the Skool integration to forge a SUPERADMIN session, allowing impersonation of arbitrary organizations.

Postiz, an AI social media scheduling tool, prior to commit da44801 contains a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow. Any unauthenticated user can execute arbitrary code during the Docker build process and exfiltrate a highly privileged GITHUB_TOKEN (write-all permissions) by opening a Pull Request from a fork with a maliciously modified Dockerfile.dev.

A vulnerability in Postiz, an AI social media scheduling tool, allows a low-privileged account to grant arbitrary organizations lifetime PRO subscriptions without payment. The issue stems from missing verification of Nowpayments IPN callback authenticity and reading the subscription identifier from an untrusted request body.

Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated endpoint that accepted a signed token and applied subscription-enforcement side effects without verifying the token's intended purpose.

Postiz from version 2.21.6 to before 2.21.7 allows any authenticated user who can create a post to store arbitrary HTML in post content. The public preview link renders that HTML with dangerouslySetInnerHTML on the main application origin.

Postiz is an AI social media scheduling tool. In versions from 2.16.6 to 2.21.6, SSRF protections have a TOCTOU vulnerability: the isSafePublicHttpsUrl() function resolves DNS to validate the IP, but subsequent fetch() calls resolve DNS independently. An attacker controlling a DNS server can exploit this via DNS rebinding to redirect requests to internal network addresses. This issue has been patched in version 2.21.7.

Postiz prior to version 2.21.4 has a blind SSRF vulnerability in the POST /webhooks/ endpoint. URL validation does not block internal/private addresses, allowing attackers to make requests to internal services.