{"schema_version":1,"title":"GitroomHQ vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 8 vulnerabilities in GitroomHQ: 0 in the last 7 days and 6 in the last 90 days, 5 of them critical and 0 exploited in the wild. The most recent, CVE-2026-115933, was published on 24 October 2026. 3 vulnerabilities in the last four weeks, level on the four before (3). 3 critical against 1. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/gitroomhq","json_url":"https://junglewise.ai/threats/vendors/gitroomhq.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/gitroomhq","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","thin":false,"counts":{"high":2,"all_time":8,"critical":5,"exploited":0,"last_7_days":0,"last_30_days":3,"last_90_days":6,"last_365_days":8},"latest":[{"cve":"CVE-2026-115933","cvss":9.9,"slug":"cve-2026-115933-postiz-signs-its-session-invitation-and-password-reset-tokens","title":"GitroomHQ postiz-app token signature forgery","severity":"critical","exploited":false,"published_at":"2026-10-24T15:17:33.957+00:00","url":"https://junglewise.ai/threats/cve-2026-115933-postiz-signs-its-session-invitation-and-password-reset-tokens"},{"cve":"CVE-2026-115932","cvss":9.6,"slug":"cve-2026-115932-when-a-post-is-published-postiz-treats-a-media-path-that-is-not","title":"Postiz path traversal in post media processing","severity":"critical","exploited":false,"published_at":"2026-10-24T13:16:37.217+00:00","url":"https://junglewise.ai/threats/cve-2026-115932-when-a-post-is-published-postiz-treats-a-media-path-that-is-not"},{"cve":"CVE-2026-115931","cvss":9.9,"slug":"cve-2026-115931-postiz-lets-a-signed-in-user-ask-the-backend-to-run-a-function","title":"GitroomHQ Postiz arbitrary file read and denial of service","severity":"critical","exploited":false,"published_at":"2026-10-23T23:17:43.263+00:00","url":"https://junglewise.ai/threats/cve-2026-115931-postiz-lets-a-signed-in-user-ask-the-backend-to-run-a-function"},{"cve":"CVE-2026-107761","epss":0.0028,"slug":"cve-2026-107761-several-postiz-endpoints-return-the-complete-database-row-of-the","title":"Postiz information disclosure in API responses","severity":"info","exploited":false,"published_at":"2026-10-11T16:16:30.49+00:00","url":"https://junglewise.ai/threats/cve-2026-107761-several-postiz-endpoints-return-the-complete-database-row-of-the"},{"cve":"CVE-2026-94456","cvss":9.1,"epss":0.0052,"slug":"cve-2026-94456-postiz-generates-security-sensitive-credentials-using-math-random","title":"GitroomHQ Postiz insecure random source in credential generation","severity":"critical","exploited":false,"published_at":"2026-09-22T17:17:31.67+00:00","url":"https://junglewise.ai/threats/cve-2026-94456-postiz-generates-security-sensitive-credentials-using-math-random"},{"cve":"CVE-2026-94455","cvss":7.1,"epss":0.0026,"slug":"cve-2026-94455-an-http-endpoint-intended-for-provisioning-enterprise-and","title":"Postiz /enterprise/create-user authentication bypass privilege escalation","severity":"high","exploited":false,"published_at":"2026-09-22T17:17:31.497+00:00","url":"https://junglewise.ai/threats/cve-2026-94455-an-http-endpoint-intended-for-provisioning-enterprise-and"},{"cve":"CVE-2026-48781","cvss":9.9,"epss":0.0026,"slug":"cve-2026-48781-postiz-privilege-escalation-via-jwt-forgery-in-skool-integration","title":"Postiz privilege escalation via JWT forgery in Skool integration","severity":"critical","exploited":false,"published_at":"2026-06-17T13:20:43.06+00:00","url":"https://junglewise.ai/threats/cve-2026-48781-postiz-privilege-escalation-via-jwt-forgery-in-skool-integration"},{"cve":"CVE-2026-34577","cvss":8.6,"epss":0.0047,"slug":"cve-2026-34577-postiz-ssrf-in-publiccontroller-stream-endpoint","title":"Postiz SSRF in PublicController stream endpoint","severity":"high","exploited":false,"published_at":"2026-04-02T18:16:30.347+00:00","url":"https://junglewise.ai/threats/cve-2026-34577-postiz-ssrf-in-publiccontroller-stream-endpoint"}],"vendor":{"hub":true,"name":"GitroomHQ","slug":"gitroomhq","description":"Platform for scheduling and managing social media content distribution.","url":"https://junglewise.ai/threats/vendors/gitroomhq"},"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":1,"exploited":0,"vulnerabilities":2},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":3,"exploited":0,"vulnerabilities":3},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-48781","cvss":9.9,"epss":0.0026,"slug":"cve-2026-48781-postiz-privilege-escalation-via-jwt-forgery-in-skool-integration","title":"Postiz privilege escalation via JWT forgery in Skool integration","severity":"critical","exploited":false,"published_at":"2026-06-17T13:20:43.06+00:00","url":"https://junglewise.ai/threats/cve-2026-48781-postiz-privilege-escalation-via-jwt-forgery-in-skool-integration"},{"cve":"CVE-2026-115933","cvss":9.9,"slug":"cve-2026-115933-postiz-signs-its-session-invitation-and-password-reset-tokens","title":"GitroomHQ postiz-app token signature forgery","severity":"critical","exploited":false,"published_at":"2026-10-24T15:17:33.957+00:00","url":"https://junglewise.ai/threats/cve-2026-115933-postiz-signs-its-session-invitation-and-password-reset-tokens"},{"cve":"CVE-2026-115931","cvss":9.9,"slug":"cve-2026-115931-postiz-lets-a-signed-in-user-ask-the-backend-to-run-a-function","title":"GitroomHQ Postiz arbitrary file read and denial of service","severity":"critical","exploited":false,"published_at":"2026-10-23T23:17:43.263+00:00","url":"https://junglewise.ai/threats/cve-2026-115931-postiz-lets-a-signed-in-user-ask-the-backend-to-run-a-function"},{"cve":"CVE-2026-115932","cvss":9.6,"slug":"cve-2026-115932-when-a-post-is-published-postiz-treats-a-media-path-that-is-not","title":"Postiz path traversal in post media processing","severity":"critical","exploited":false,"published_at":"2026-10-24T13:16:37.217+00:00","url":"https://junglewise.ai/threats/cve-2026-115932-when-a-post-is-published-postiz-treats-a-media-path-that-is-not"},{"cve":"CVE-2026-94456","cvss":9.1,"epss":0.0052,"slug":"cve-2026-94456-postiz-generates-security-sensitive-credentials-using-math-random","title":"GitroomHQ Postiz insecure random source in credential generation","severity":"critical","exploited":false,"published_at":"2026-09-22T17:17:31.67+00:00","url":"https://junglewise.ai/threats/cve-2026-94456-postiz-generates-security-sensitive-credentials-using-math-random"},{"cve":"CVE-2026-34577","cvss":8.6,"epss":0.0047,"slug":"cve-2026-34577-postiz-ssrf-in-publiccontroller-stream-endpoint","title":"Postiz SSRF in PublicController stream endpoint","severity":"high","exploited":false,"published_at":"2026-04-02T18:16:30.347+00:00","url":"https://junglewise.ai/threats/cve-2026-34577-postiz-ssrf-in-publiccontroller-stream-endpoint"},{"cve":"CVE-2026-94455","cvss":7.1,"epss":0.0026,"slug":"cve-2026-94455-an-http-endpoint-intended-for-provisioning-enterprise-and","title":"Postiz /enterprise/create-user authentication bypass privilege escalation","severity":"high","exploited":false,"published_at":"2026-09-22T17:17:31.497+00:00","url":"https://junglewise.ai/threats/cve-2026-94455-an-http-endpoint-intended-for-provisioning-enterprise-and"},{"cve":"CVE-2026-107761","epss":0.0028,"slug":"cve-2026-107761-several-postiz-endpoints-return-the-complete-database-row-of-the","title":"Postiz information disclosure in API responses","severity":"info","exploited":false,"published_at":"2026-10-11T16:16:30.49+00:00","url":"https://junglewise.ai/threats/cve-2026-107761-several-postiz-endpoints-return-the-complete-database-row-of-the"}],"generated_at":"2026-11-11T03:07:00.183524+00:00","technologies":[{"name":"GitroomHQ Postiz-App","slug":"postiz-app","vulnerabilities":5,"url":"https://junglewise.ai/threats/technologies/postiz-app"}]}