Executive brief
Postiz is an AI-powered social media scheduling platform. A security flaw allows users with post-creation permissions to inject malicious code into post previews. If another user, such as an administrator, views this preview, the attacker could take over their account, steal API tokens, or delete team data and integrations.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in Postiz versions 2.21.6 through 2.21.6. The root cause is the use of 'dangerouslySetInnerHTML' on the public preview page (/p/<postId>?share=true), which renders unsanitized HTML content from the database. An authenticated attacker can bypass client-side restrictions by tampering with the save request to include malicious scripts. When a victim (such as an admin) views the shared preview link, the script executes in their browser context, potentially allowing for session hijacking, API token theft, and unauthorized administrative actions. The issue is fixed in version 2.21.7.
Affected products
- Gitroom Postiz 2.21.6 to < 2.21.7
Timeline
- 2026-04-20: disclosed: Postiz received the advisory from the reporter.
- 2026-04-27: patched: Fix developed and version 2.21.7 released.
- 2026-05-08: advisory: CVE-2026-42556 published.