CVE-2026-115933

Summary

The application uses a single shared secret and lacks token-type markers to sign session, invitation, password reset, and provisioning tokens, allowing an authenticated attacker to forge arbitrary tokens by exploiting a credential-refresh endpoint that signs user-controlled input and returns the signed result.

Exploitability

Exploitation requires authenticated access and knowledge of the vulnerable endpoint; no special tools or privileges beyond a valid session token are needed.

Blast radius

An attacker could forge valid session tokens to impersonate any user, issue themselves elevated invitations (e.g., admin roles), reset passwords for arbitrary accounts, or obtain enterprise provisioning tokens—fully compromising confidentiality, integrity, and availability across the system.

Detection

Monitor for anomalous requests to the credential-refresh endpoint that return signed tokens containing claims inconsistent with the user’s current role or session scope—specifically, look for logs showing self-issued invitations with elevated roles or password-reset tokens for accounts unrelated to the requester.

Prioritized remediation

Upgrade to Postiz version 2.590 or later, which separates token signing keys by type and includes explicit token-type markers; if upgrading is not immediately possible, disable the credential-refresh endpoint until a patch is applied.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.