CVE-2026-115933

The record

Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token. A second, narrower route that creates team invitations signs extra fields from the request body in the same way.

Affected packages

Related vulnerabilities

• CVE-2026-63115 ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. CWE-290
• CVE-2026-104623 A security vulnerability exists in the authorization handling for the local (management)… CWE-290
• CVE-2026-119703 xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in… CWE-290
• CVE-2026-104615 A security vulnerability was discovered in SUSE Rancher Fleet's cluster registration… CWE-290
• CVE-2026-91914 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by… CWE-290
• CVE-2026-119425 OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in… CWE-290
• CVE-2026-115962 Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity… CWE-290
• CVE-2026-118653 Echo is a Go web framework. CWE-290