CVE-2026-48781

Name of the Vulnerable Software and Affected Versions Postiz versions prior to 2.21.8

Description An issue in the Skool integration callback allows the application to sign an attacker-controlled JSON blob into a session-shape JSON Web Token (JWT) using the JWT SECRET. Because the authentication middleware trusts every claim in the JWT without re-verifying the user against the database, any authenticated user can forge a SUPERADMIN session. This enables the impersonation of arbitrary organizations and provides full access to all parts of the application, including registered users and the ability to post to the social media channels of victims linked to the instance.

Recommendations Update to version 2.21.8.