gitroomhq vulnerabilities

CVEs per yearBy the year they were published

1. 20251
2. 202619

Newest CVEs

• CVE-2026-115933

  Forged signed tokens let any registered user take over other users and organizations

  GitroomHQ · postiz-app

  Critical9.9
• CVE-2026-115932

  Path traversal in post media lets any registered user read server files

  GitroomHQ · postiz-app

  Critical9.6
• CVE-2026-115931

  Arbitrary file read and backend crash through unrestricted provider method calls

  GitroomHQ · postiz-app

  Critical9.9
• CVE-2026-107761

  Channel tokens and organization API key exposed in API responses

  GitroomHQ · postiz-app

  Medium5.3
• CVE-2026-94455

  Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key

  GitroomHQ · postiz-app

  High7.1
• CVE-2026-94456

  Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys

  GitroomHQ · postiz-app

  Critical9.1
• CVE-2026-19264

  Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

  gitroomhq · postiz-app

  Critical9.3
• CVE-2026-19127

  Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions

  GitroomHQ · postiz-app

  Medium6.5
• CVE-2026-48799

  Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook

  gitroomhq · postiz-app

  High7.7
• CVE-2026-48783

  Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription

  gitroomhq · postiz-app

  Medium4.8