CVE-2026-115933

Name of the Vulnerable Software and Affected Versions Postiz (affected versions not specified)

Description Postiz uses a single shared secret to sign session, invitation, and password reset tokens without including a marker to distinguish the token purpose. A route used to refresh browser-extension channel credentials signs data provided in the request and stores the result for the user to retrieve. This allows a user to forge a validly signed token with arbitrary claims, which the application may accept as a session token, an organization invitation with a specific role, a password reset token, or an enterprise provisioning token. Additionally, a route for creating team invitations signs extra fields from the request body using the same flawed mechanism.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.