CVE-2026-115933 Forged signed tokens let any registered user take over other users and organizations
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-115933?
CVE-2026-115933 is a critical vulnerability in GitroomHQ postiz-app, published on 24 Oct 2026.
Official description
Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token.
A second, narrower route that creates team invitations signs extra fields from the request body in the same way.
Which versions are affected by CVE-2026-115933?
How do I fix CVE-2026-115933?
No fix has been published for CVE-2026-115933 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-115933 being exploited?
There is no known exploitation of CVE-2026-115933 in the wild and no public exploit code.
Sources
Also known as GHSA-9j6f-8rw3-93c4.