The vulnerability arises from Postiz’s backend lacking restrictions on provider method calls, allowing signed‑in users to invoke internal helper functions that should not be exposed. An attacker can trigger a helper that reads arbitrary server files, exposing secrets such as session signing keys, database credentials, and environment variables. A second helper can terminate the backend process, resulting in a denial of service. The flaw therefore enables inadvertent information disclosure and service interruption.

The issue affects GitroomHQ Postiz‑App installations prior to version 2.25.1, which introduced the provider‑method whitelist. Any deployment lacking that fix remains vulnerable, including the release tagged v2.25.0 and earlier.

The CVSS score of 9.9 indicates a high severity vulnerability. While the EPSS score is unavailable and the flaw is not yet listed in KEV, the risk remains significant. An attacker only needs an ordinary user account, readily obtainable through the default self‑registration option. Once authenticated, the attacker can issue requests that trigger the unprotected helper methods, reading sensitive files or crashing the service via the web interface. This makes the flaw readily exploitable for users who create an account, without requiring elevated privileges.