Quick answers
- Is CVE-2026-42556 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-42556 being exploited in the wild.
- How severe is CVE-2026-42556?
- High severity, with a CVSS score of 8.9, published 8 May 2026.
- Which products and versions are affected?
- Gitroom Postiz 2.21.6 to < 2.21.7.
- Is there a fix for CVE-2026-42556?
- A patch was published on 2026-04-27: Fix developed and version 2.21.7 released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-42556 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-42556?
- Check whether you run Gitroom Postiz at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in Postiz versions 2.21.6 through 2.21.6. The root cause is the use of 'dangerouslySetInnerHTML' on the public preview page (/p/<postId>?share=true), which renders unsanitized HTML content from the database. An authenticated attacker can bypass client-side restrictions by tampering with the save request to include malicious scripts. When a victim (such as an admin) views the shared preview link, the script executes in their browser context, potentially allowing for session hijacking, API token theft, and unauthorized administrative actions. The issue is fixed in version 2.21.7.
Affected products
- Gitroom Postiz 2.21.6 to < 2.21.7
Timeline
- 2026-04-20: disclosed: Postiz received the advisory from the reporter.
- 2026-04-27: patched: Fix developed and version 2.21.7 released.
- 2026-05-08: advisory: CVE-2026-42556 published.