Critical Token Signing Vulnerability in Postiz App: CVE-2026-115933
A critical vulnerability (CVE-2026-115933, CVSS 9.9) was discovered in the Postiz app, affecting versions 2.15.0 to 2.25.3. The vulnerability allows an attacker to forge validly signed tokens for sessions, invitations, password resets, or enterprise provisioning due to improper token signing and lack of token type markers. This could lead to unauthorized access, privilege escalation, and potential supply chain compromise. Immediate patching to version 2.25.3 or later is strongly recommended.