Postiz signs session, invitation, and password reset tokens with a single shared secret and no indicator of the token type, exposing the application to authentication and integrity weaknesses classified as CWE‑290, CWE‑345, and CWE‑915. A route that refreshes browser‑extension credentials blindly signs data from the request and returns it to the requester, allowing any registered user to generate a signed token with arbitrary claims. This can be used as a session token, an organization invitation with any role, a password reset token, or an enterprise provisioning token. Consequently, an authenticated attacker can impersonate other users, take over organizations, reset passwords, and create privileged invitations.

The vulnerability affects GitroomHQ’s Postiz application, specifically versions prior to the 2.25.3 release. All installations using the legacy signing mechanism without the subsequent patch are vulnerable.

This high‑severity flaw, scored 9.9 on CVSS, indicates a full breach of confidentiality, integrity, and availability. The EPSS score is not available, so an exact exploitation probability cannot be quantified, and the vulnerability is not listed in the KEV catalog. An attacker only needs an ordinary account and the ability to hit the vulnerable route, making exploitation straightforward once access is granted. Organizations should therefore treat this as an urgent risk requiring immediate mitigation.