CVE-2026-94455
Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key
- Published
- Updated
- Reserved
- Assigned by
- postiz
Description
An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The endpoint's only check is that the request body carries a token bearing a valid signature from the instance secret. It does not check what that token was issued for. Login tokens are signed with the same secret and carry no purpose, audience or expiry claim, so an ordinary user's own session token satisfies the check. Presented with such a token, the endpoint creates a new organisation holding the highest subscription tier, flagged as lifetime and with a channel allowance far above any sold plan, creates an organisation-owner account alongside it, and returns the new organisation's API key in the response body. That key is immediately valid against the public API.
Timeline
ID reserved
By postiz
- 1 day later
· 1 day later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| postizCNA (assigner) | 3.1 | High7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L |
| NVDNVD · Awaiting Analysis | 3.1 | High7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L |
- EPSS (exploitation in 30 days)
- 0.26% · top 82% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.
Weakness
Affected products
- affected < 2.4.0
What to do
Workaround: Block POST /enterprise/create-user, and preferably all of /enterprise/*, at your reverse proxy, ingress or WAF. If you do not use Postiz's enterprise or reseller provisioning integration, nothing legitimate calls these routes, so blocking them has no user-visible effect.
Workaround: Set DISABLE_REGISTRATION=true. The caller needs an ordinary account on your instance to obtain a usable token, so closing self-registration limits exposure to people who already have one. This reduces reach, it does not close the issue.
Exploitation: 1. Register an ordinary account on the target instance and capture that account's own login JWT.
Exploitation: 2. POST /api/enterprise/create-user with body {"params": "<that login JWT, verbatim>"}.
Exploitation: 3. The response is 200 with {"id": "<new organisation id>", "apiKey": "<key>"}.
Exploitation: 4. Confirm the new organisation carries subscriptionTier=ULTIMATE, isLifetime=true and totalChannels=1000000, and that it is distinct from the caller's own registration organisation.
Exploitation: 5. Send the returned apiKey as the Authorization header against a public API endpoint and confirm 200, versus 401 for an invalid key.
Exploitation: Controls: an absent token, a malformed token, and a token with a valid-looking payload but a wrong signature all fail with no organisation created, confirming signature verification is the only gate.
References (4)
- Postiz (opens in a new tab)product
- v2.24.0 (opens in a new tab)release-notes
- 9259cf2 (opens in a new tab)patch
- GAdvisory (opens in a new tab)vendor-advisory
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-94455)Record last updated .