# CVE-2026-107761: Postiz information disclosure in API responses

Source: https://junglewise.ai/threats/cve-2026-107761-several-postiz-endpoints-return-the-complete-database-row-of-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-11. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-107761 · Severity: info · Published 2026-10-11

Postiz, a social media management platform, returns sensitive credentials in API responses that callers should not receive. OAuth apps deleting a channel receive the channel's social platform access tokens, allowing them to act on connected accounts outside Postiz. Organization members without admin privileges can obtain the organization API key from the GET /user/organizations endpoint and use the API with elevated privileges.

Technologies: [GitroomHQ Postiz-App](https://junglewise.ai/threats/technologies/postiz-app). Vendors: [GitroomHQ](https://junglewise.ai/threats/vendors/gitroomhq).

## Quick answers

**Is CVE-2026-107761 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107761 being exploited in the wild.

**How severe is CVE-2026-107761?** Informational severity, published 11 October 2026.

**Which products and versions are affected?** GitroomHQ Postiz-App before 2.25.1.

**Is there a fix for CVE-2026-107761?** Yes: fixed in 2.25.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107761 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-107761?** Check whether you run GitroomHQ Postiz-App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.25.1

## Technical details

Two API endpoints return complete database rows instead of filtered fields: DELETE channel endpoint returns platform access and refresh tokens, and GET /user/organizations returns the organization API key to all members. Both vulnerabilities are scoped to authenticated callers within their own organization; there is no cross-tenant exposure. An attacker with valid credentials and appropriate scopes can access secrets intended for a different privilege level.

## Affected products

- GitroomHQ postiz-app before 2.25.1

## Timeline

- 2026-10-01: disclosed: Postiz discovered the vulnerability
- 2026-10-08: patched: Postiz developed and verified a patch
- 2026-10-11: advisory

## References

- [https://gadvisory.org/advisories/PSA-2026-4QX1WG](https://gadvisory.org/advisories/PSA-2026-4QX1WG)
- [https://github.com/gitroomhq/postiz-app/commit/8ad0df3df0f21299b8640568358c1b68c6464e4f](https://github.com/gitroomhq/postiz-app/commit/8ad0df3df0f21299b8640568358c1b68c6464e4f)

## Related threats

- [GitroomHQ postiz-app token signature forgery](https://junglewise.ai/threats/cve-2026-115933-postiz-signs-its-session-invitation-and-password-reset-tokens)
- [Postiz path traversal in post media processing](https://junglewise.ai/threats/cve-2026-115932-when-a-post-is-published-postiz-treats-a-media-path-that-is-not)
- [GitroomHQ Postiz arbitrary file read and denial of service](https://junglewise.ai/threats/cve-2026-115931-postiz-lets-a-signed-in-user-ask-the-backend-to-run-a-function)
- [GitroomHQ Postiz insecure random source in credential generation](https://junglewise.ai/threats/cve-2026-94456-postiz-generates-security-sensitive-credentials-using-math-random)