PT-2026-110216
CVE-2026-107761
·
Published
2026-10-11
·
Updated
2026-10-11
Description by
CVSS 4.0
5.3
MediumMetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Postiz (affected versions not specified)
Description
Several endpoints return complete database rows instead of specific required fields, leading to the exposure of sensitive secrets. The channel delete endpoint returns the deleted integration row, which includes the platform access token and refresh token, allowing a third-party OAuth app to obtain social platform credentials. Additionally, the
GET /user/organizations endpoint returns the organization row including the API key to all members, enabling users with lower roles to obtain the key intended for admins and call the public API on behalf of the organization. Access to these endpoints requires a valid session, API key, or OAuth token and is restricted to the caller's own organization.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾