Is CVE-2026-115933 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115933 being exploited in the wild.

How severe is CVE-2026-115933?

Critical severity, with a CVSS score of 9.9, published 24 October 2026.

Which products and versions are affected?

GitroomHQ Postiz-App 2.15.0 to 2.25.2.

How is CVE-2026-115933 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-115933?

Check whether you run GitroomHQ Postiz-App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115933: GitroomHQ postiz-app token signature forgery

CVE-2026-115933 · Severity: critical · CVSS 9.9 · Published 2026-10-24

Postiz is a social media scheduling tool used to manage posts across multiple platforms. A vulnerability in its token signing mechanism allows any registered user to forge valid authentication and authorization tokens, enabling them to take over other users' accounts, reset passwords, join organizations as administrators, and access sensitive API keys. This is a critical vulnerability with no user interaction required.

Technologies: GitroomHQ Postiz-App. Vendors: GitroomHQ.

Quick answers

Is CVE-2026-115933 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115933 being exploited in the wild.
How severe is CVE-2026-115933?: Critical severity, with a CVSS score of 9.9, published 24 October 2026.
Which products and versions are affected?: GitroomHQ Postiz-App 2.15.0 to 2.25.2.
Is there a fix for CVE-2026-115933?: Yes: fixed in 2.25.3. Until then: Block POST /integrations/extension-refresh at your reverse proxy to close the main signing route (note: the team invitation route remains vulnerable). Set DISABLE_REGISTRATION=true to prevent self-registration by new attackers, though this does not fully mitigate the issue for existing registered users. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115933 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-115933?: Check whether you run GitroomHQ Postiz-App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.25.3

Block POST /integrations/extension-refresh at your reverse proxy to close the main signing route (note: the team invitation route remains vulnerable). Set DISABLE_REGISTRATION=true to prevent self-registration by new attackers, though this does not fully mitigate the issue for existing registered users.

Technical details

Postiz uses a single shared secret to sign session, password reset, invitation, and enterprise provisioning tokens without differentiation markers, allowing confusion between token types. Two vulnerable endpoints—POST /integrations/extension-refresh and a team invitation creation route—sign user-controlled request data and return it to the attacker, enabling arbitrary token forgery. An authenticated attacker can craft tokens containing any claims they choose, which the application accepts as valid for account takeover, privilege escalation, and data exfiltration.

Affected products

GitroomHQ postiz-app 2.15.0 to 2.25.2

Timeline

2026-10-23: disclosed: Anthropic disclosed vulnerability to Postiz with working proof of concept
2026-10-24: patched: Postiz released fix in version 2.25.3
2026-10-24: advisory: Public advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.