Postiz Fixes 3 Critical Flaws That Let Signed-In Users Read Server Secrets or Forge Logins. Update to 2.25.3

TL;DR: If you self-host Postiz, the open-source social media scheduler, update to version 2.25.3 now. Postiz has fixed three critical flaws in two days that let a signed-in user read server files, including secrets, or take over other people’s accounts. The worst new one, CVE-2026-115933 (CVSS 9.9), lets a user who connects their own Skool account forge login, invitation and password reset tokens and join any organization on the instance as super administrator. It affects versions 2.15.0 through 2.25.2. CVE-2026-115932 (CVSS 9.6) lets a user read server files through post media if the Discord provider or certain other settings are configured, and CVE-2026-115931 (CVSS 9.9), fixed in 2.25.2, lets a user read server files, including the secret that signs login sessions. New sign-ups are open by default, so “signed-in user” can mean anyone who finds your instance. Updating closes the holes, but it doesn’t undo anything someone already read or signed, so rotate your secrets too.

What happened

Postiz published three advisories in two days, all rated Critical on CVSS 3.1 and all credited to Anthropic, PBC, as the finder:

• CVE-2026-115931 (9.9), advisory PSA-2026-JNXM56, October 23. Postiz lets a signed-in user ask the backend to run a function on one of their connected channels, but the backend “did not restrict which functions can be requested.” One reachable helper reads any file the backend can read, including its environment, which holds the session-signing secret (JWT_SECRET), the database and Redis connection strings and the credentials of connected services. Another ends the backend process with a single request. Versions 2.23.0 through 2.25.1 are affected; the fix shipped in v2.25.2 at 21:59 UTC on October 23 (5:59 a.m. on October 24, Manila time).
• CVE-2026-115932 (9.6), advisory PSA-2026-E9AHFV, October 24. When a post is published, Postiz treats a media path that isn’t a web address as a file on the server and “does not check that the file lies inside the upload directory.” A user can have the publishing worker read any file and send it as an attachment to a Discord server they control. The advisory says that main route needs the Discord provider to be configured, and the shipped Docker Compose file leaves it empty; two other routes need a Dribbble, TikTok or Pinterest provider, or local storage with an empty cloud bucket URL. One of them can also exhaust the backend’s memory with a single request. Versions 2.23.0 through 2.25.2 are affected.
• CVE-2026-115933 (9.9), advisory PSA-2026-YT2HMH, October 24. Postiz signs its session, invitation and password reset tokens “with one shared secret and without any marker of what a token is for.” A route that refreshes a browser-extension channel signed data taken from the request and let the user read it back, so a user who connects their own Skool account could get a validly signed token with any claims they choose. The advisory says the instance only has to be able to reach Skool’s API, and no setting has to be changed. The advisory says that lets an attacker sign in as other users, reset the password of a user whose ID they know, and join any other organization as super administrator using an organization ID exposed by any shared post preview link, then read its API key and schedule posts through its connected social accounts. It says forged tokens “do not expire and cannot be told apart from genuine ones.” Versions 2.15.0 through 2.25.2 are affected, so this one reaches older installs than the other two.

Both new flaws are fixed in v2.25.3, released on GitHub at 14:16 UTC on October 24 (10:16 p.m. Manila). New sign-ups are open unless DISABLE_REGISTRATION is set to true, and all three advisories say setting it “reduces reach, it does not close the issue.”

Each advisory says exploitation was demonstrated end to end against unmodified Postiz builds using self-registered accounts. Those are research demonstrations, not attack reports. As of our check, none of the three is in CISA’s Known Exploited Vulnerabilities catalog, and we found no reports of attacks.

Why it matters

Postiz’s website says most solo creators pick its Standard plan and that small brands and agencies managing a handful of accounts usually choose Team or Pro, and its README lists more than a dozen networks it can post to, including X, LinkedIn and Instagram. A self-hosted instance is a store of keys: it holds working tokens for every brand account you’ve connected. Depending on your setup, these flaws give an attacker with any account on your instance several ways in: read the server’s secrets, sign in as you, or make themselves super administrator of your organization and post through your brands.

Open registration makes this worse. An attacker doesn’t need an invitation: they can sign up and use the flaws right away.

If you updated to 2.25.2 for CVE-2026-115931, you’re not done: 2.25.2 doesn’t fix the two newer flaws.

What to do now

1. Check your version. Look at the image tag in your Docker Compose file or in docker ps. Anything from 2.15.0 to 2.25.2 is affected by at least one of the three flaws. The shipped Compose file uses the latest tag, so pull the image again to be sure you have 2.25.3.
2. Update to 2.25.3 or later and restart the containers.
3. Close sign-ups if you don’t need them. Set DISABLE_REGISTRATION=true in your environment. Postiz says this “reduces reach, it does not close the issue,” because existing users can still use the flaws. Treat it as hygiene, not a fix.
4. Rotate JWT_SECRET. Set a new long random value and restart. Because forged tokens don’t expire, changing the secret that signed them is the way to make them stop working. It also signs everyone out. Postiz uses this secret to encrypt some data it stores, so back up your database first and expect to re-enter or reconnect anything that stops working afterward.
5. Change the database and Redis passwords in DATABASE_URL and REDIS_URL, especially if either is reachable from outside the server.
6. Reconnect your social channels and replace your Postiz API keys. Disconnect and reconnect each account in Postiz, and revoke the old app access in each network’s settings so leaked tokens stop working.
7. Rotate the other keys in your .env file, such as storage, email, AI provider, Discord and payment keys.
8. Look for strangers. Review the user list and each organization’s members and admins for accounts you don’t recognize, and check backend logs for unexpected crashes or restarts since you installed 2.23.0 or later.
9. Keep it off the open internet if you can. A VPN or an IP allowlist limits who can reach the sign-up page at all.

Steps 4 to 9 are our own advice based on standard practice for leaked secrets, not Postiz’s instructions; the encryption detail in step 4 comes from Postiz’s source code. If you can’t update today, Postiz’s advisories also list two narrower workarounds: block POST /integrations/extension-refresh at your reverse proxy if you don’t use browser-extension channels (CVE-2026-115933), and leave the Discord provider unconfigured if you don’t need it (CVE-2026-115932). Neither closes every route. The same rotate-everything routine applies to the Railway environment variable disclosure and the LiteLLM credential stealer.

Updates

• Oct 27, 2026, 12:26 p.m. Manila: First published, covering CVE-2026-115931 (fixed in 2.25.2) and CVE-2026-115932 and CVE-2026-115933 (fixed in 2.25.3). The advisories don’t say how many instances are exposed or whether Postiz’s hosted service was affected. We’ll add a dated note here if attacks are reported or CISA lists any of the flaws.

Sources & method

Sources

• Postiz (GAdvisory), PSA-2026-YT2HMH, “Forged signed tokens let any registered user take over other users and organizations,” Oct 24, 2026
• Postiz (GAdvisory), PSA-2026-E9AHFV, “Path traversal in post media lets any registered user read server files,” Oct 24, 2026
• Postiz (GAdvisory), PSA-2026-JNXM56, “Arbitrary file read and backend crash through unrestricted provider method calls,” Oct 23, 2026
• CVE records (CNA: Postiz): CVE-2026-115933, CVE-2026-115932 and CVE-2026-115931
• Postiz v2.25.3 release notes and v2.25.2 release notes
• Fix commits: a5affe6, “fix: jwt bypass”, 12db9bd, “fix: access to local files” and 9383f5b
• GitHub Advisory Database (unreviewed): GHSA-9j6f-8rw3-93c4 (CVE-2026-115933), GHSA-rmc2-p2gv-m88f (CVE-2026-115932) and GHSA-h5r5-h782-vqvp (CVE-2026-115931)
• Postiz .env.example (JWT_SECRET, DATABASE_URL, REDIS_URL, DISABLE_REGISTRATION) and docker-compose.yaml at v2.25.3 (image tag, empty Discord settings)
• Postiz auth.service.ts at v2.25.3 (JWT_SECRET signs tokens and derives the encryption key)
• Postiz README (supported networks, team features)
• Postiz website (plans for creators, brands and agencies)
• CISA Known Exploited Vulnerabilities catalog

Method. Checked October 27, 2026, 12:26 p.m. Manila. The affected and fixed versions, CVSS scores, impacts, workarounds, configurations and credits come from the three Postiz advisories and match the CVE records; the release times and fix commits come from the Postiz GitHub repository; KEV status comes from CISA’s catalog (version 2026.10.26). The note that Postiz signs tokens with and encrypts some stored data using JWT_SECRET is from the advisories and the Postiz source code (auth.service.ts). The steps under “What to do now,” except the DISABLE_REGISTRATION and reverse-proxy and Discord workarounds, are our own judgment. No affiliate links on this page. How we work.