Unauthorized Function Execution in Postiz by Gitroom
CVE-2026-115931

9.9CRITICAL

Key Information:

Vendor

Gitroomhq

Status
Postiz-app
Vendor
CVE Published:
23 October 2026

Badges

👾 Exploit Exists

What is CVE-2026-115931?

Postiz allows authenticated users to invoke backend functions without proper restrictions, potentially exposing sensitive server files. Through this vulnerability, users can access critical information, including the server's environment variables, which may contain confidential database credentials and tokens. Additionally, a user can trigger the backend to terminate processes, leading to potential service disruptions. The issue is aggravated by the self-registration feature, allowing unauthorized users to gain access without prior validation.

Affected Version(s)

postiz-app 2.23.0 < 2.25.2

References

https://github.com/gitroomhq/postiz-app
product
https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.1
release-notes
https://github.com/gitroomhq/postiz-app/commit/9383f5be4d...
patch

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anthropic, PBC
Enno Gelhaus
Nevo David
.