# CVE-2026-94455: Postiz /enterprise/create-user authentication bypass privilege escalation

Source: https://junglewise.ai/threats/cve-2026-94455-an-http-endpoint-intended-for-provisioning-enterprise-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-94455 · Severity: high · CVSS 7.1 · Published 2026-09-22

Postiz, a social media scheduling platform, contains an unauthenticated endpoint that any registered user can exploit to create premium organizations with lifetime billing status and extract their API keys. An attacker with a basic user account can send their own login token to the /enterprise/create-user endpoint to mint a top-tier organization with unlimited resource allocations, immediately gaining full API access and consuming the operator's AI and GPU budget indefinitely. This affects deployments with billing enabled and enables privilege escalation from ordinary user to organization administrator with premium entitlements.

Vendors: [GitroomHQ](https://junglewise.ai/threats/vendors/gitroomhq).

## Quick answers

**Is CVE-2026-94455 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-94455 being exploited in the wild.

**How severe is CVE-2026-94455?** High severity, with a CVSS score of 7.1, published 22 September 2026.

**Which products and versions are affected?** GitroomHQ Postiz < 2.4.0.

**Is there a fix for CVE-2026-94455?** A patch was published on 2026-09-22: Fixed in version 2.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-94455 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-94455?** Check whether you run GitroomHQ Postiz at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The /enterprise/create-user endpoint is not protected by authentication middleware due to the enterprise controller being excluded from the whitelist. The endpoint only validates that a request body token carries a valid signature from the instance JWT secret, but does not verify the token's intended purpose, audience, or expiry. Since login tokens are signed with the same secret and lack purpose claims, any registered user can replay their own session token to create a new organization with subscriptionTier=ULTIMATE, isLifetime=true, and totalChannels=1000000, receiving the organization's API key in the response.

## Affected products

- GitroomHQ Postiz < 2.4.0

## Timeline

- 2026-09-22: disclosed: Public advisory PSA-2026-P8W1J0 published
- 2026-09-22: patched: Fixed in version 2.4.0

## References

- [https://gadvisory.org/advisories/PSA-2026-P8W1J0](https://gadvisory.org/advisories/PSA-2026-P8W1J0)
- [https://github.com/gitroomhq/postiz-app](https://github.com/gitroomhq/postiz-app)