Executive brief
A security flaw in the automated build system for Postiz, a social media scheduling tool, allows unauthorized individuals to take control of the software's development environment. By submitting a malicious contribution request, an attacker can steal high-level access keys, allowing them to modify the application's source code, delete data, or release fraudulent versions of the software. This poses a severe risk to the integrity of the product and the security of its users.
Technical details
A 'Pwn Request' vulnerability exists in the 'Build and Publish PR Docker Image' workflow (.github/workflows/pr-docker-build.yml). The root cause is the execution of a Docker build process using a 'Dockerfile.dev' that can be modified by external contributors in a Pull Request. An unauthenticated attacker can submit a PR from a fork containing a malicious Dockerfile; when the automated workflow triggers, it executes the attacker's code within the runner environment. This environment has access to a GITHUB_TOKEN with 'write-all' permissions, which can be exfiltrated to grant the attacker full read/write access to the repository, including the ability to modify code and manage releases. The issue was resolved by removing the insecure workflow in commit da44801.
Affected products
- Gitroom Postiz Before commit da44801
Timeline
- 2026-04-22: disclosed: Advisory received and acknowledged by Postiz
- 2026-04-22: patched: Fix developed and published via commit da44801
- 2026-04-26: advisory: CVE-2026-42298 assigned
- 2026-05-08: advisory: NVD publication date