Executive brief
Postiz, a social media scheduling platform, contains an unauthenticated endpoint that any registered user can exploit to create premium organizations with lifetime billing status and extract their API keys. An attacker with a basic user account can send their own login token to the /enterprise/create-user endpoint to mint a top-tier organization with unlimited resource allocations, immediately gaining full API access and consuming the operator's AI and GPU budget indefinitely. This affects deployments with billing enabled and enables privilege escalation from ordinary user to organization administrator with premium entitlements.
Technical details
The /enterprise/create-user endpoint is not protected by authentication middleware due to the enterprise controller being excluded from the whitelist. The endpoint only validates that a request body token carries a valid signature from the instance JWT secret, but does not verify the token's intended purpose, audience, or expiry. Since login tokens are signed with the same secret and lack purpose claims, any registered user can replay their own session token to create a new organization with subscriptionTier=ULTIMATE, isLifetime=true, and totalChannels=1000000, receiving the organization's API key in the response.
Affected products
- GitroomHQ Postiz < 2.4.0
Timeline
- 2026-09-22: disclosed: Public advisory PSA-2026-P8W1J0 published
- 2026-09-22: patched: Fixed in version 2.4.0