Is CVE-2026-107761 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107761 being exploited in the wild.

How severe is CVE-2026-107761?

Informational severity, published 11 October 2026.

Which products and versions are affected?

GitroomHQ Postiz-App before 2.25.1.

Is there a fix for CVE-2026-107761?

Yes: fixed in 2.25.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-107761 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-107761?

Check whether you run GitroomHQ Postiz-App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107761: Postiz information disclosure in API responses

CVE-2026-107761 · Severity: info · Published 2026-10-11

Postiz, a social media management platform, returns sensitive credentials in API responses that callers should not receive. OAuth apps deleting a channel receive the channel's social platform access tokens, allowing them to act on connected accounts outside Postiz. Organization members without admin privileges can obtain the organization API key from the GET /user/organizations endpoint and use the API with elevated privileges.

Technologies: GitroomHQ Postiz-App. Vendors: GitroomHQ.

Quick answers

Is CVE-2026-107761 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107761 being exploited in the wild.
How severe is CVE-2026-107761?: Informational severity, published 11 October 2026.
Which products and versions are affected?: GitroomHQ Postiz-App before 2.25.1.
Is there a fix for CVE-2026-107761?: Yes: fixed in 2.25.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107761 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-107761?: Check whether you run GitroomHQ Postiz-App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.25.1

Technical details

Two API endpoints return complete database rows instead of filtered fields: DELETE channel endpoint returns platform access and refresh tokens, and GET /user/organizations returns the organization API key to all members. Both vulnerabilities are scoped to authenticated callers within their own organization; there is no cross-tenant exposure. An attacker with valid credentials and appropriate scopes can access secrets intended for a different privilege level.

Affected products

GitroomHQ postiz-app before 2.25.1

Timeline

2026-10-01: disclosed: Postiz discovered the vulnerability
2026-10-08: patched: Postiz developed and verified a patch
2026-10-11: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.