https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 01:14:02 +0000 https://cve.radiocsirt.org/vuln/cve-2026-48781 <p><strong>Affected:</strong> gitroomhq postiz-app</p> <p>Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, the Skool integration callback signed an attacker-controlled JSON blob into a session-shape JWT using the application&#39;s JWT_SECRET, and the auth middleware trusted every claim in that JWT without re-resolving the user from the database. Any authenticated Postiz user could forge a SUPERADMIN session and impersonate arbitrary organizations. This allowed Full Access to the following: all parts of Postiz, including users registered to the specific instance and the ability to post in the name of the victim&#39;s social media channels added to that Postiz instance. This issue has been fixed in version 2.21.8.</p> <p><strong>Affected:</strong> gitroomhq postiz-app</p> <p>Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, the Skool integration callback signed an attacker-controlled JSON blob into a session-shape JWT using the application&#39;s JWT_SECRET, and the auth middleware trusted every claim in that JWT without re-resolving the user from the database. Any authenticated Postiz user could forge a SUPERADMIN session and impersonate arbitrary organizations. This allowed Full Access to the following: all parts of Postiz, including users registered to the specific instance and the ability to post in the name of the victim&#39;s social media channels added to that Postiz instance. This issue has been fixed in version 2.21.8.</p> https://cve.radiocsirt.org/vuln/cve-2026-48781