Neutron, our AI engine, scored 97.1% on UC Berkeley's CyberGym benchmark. Learn more

Tag

#postiz

1 articles

Deep Dive

Postiz Full Takeover by Any Registered User (CVE-2026-115931, CVE-2026-115932, CVE-2026-115933)

In self-hosted Postiz 2.23.0 to 2.25.2 any registered user can read server files, and in 2.15.0 to 2.25.2 they can forge sign-in tokens to take over other organizations; fixed in 2.25.3.

Ostorlab Team
Oct 26, 2026