An HTTP endpoint for enterprise provisioning is reachable without authentication. Because only a limited list of controllers runs the authentication middleware, the /enterprise/create-user route bypasses this check. The request only requires a token signed with the instance secret, and the same secret is used to sign login session tokens that carry no audience or expiration claim. Consequently, anyone who has a valid session token can POST to the endpoint and cause a new organization to be created with the highest subscription tier, lifetime status and a channel allowance far beyond any sold plan. The endpoint also creates an organization‑owner account and returns the new organization’s API key, which is immediately valid against the public API. This provides an attacker with full control over a newly minted enterprise organization and unrestricted access to the API.

GitroomHQ’s Postiz‑app handles the vulnerable /enterprise/create-user endpoint. The flaw appears in all versions prior to the v2.24.0 release that contains the authentication fix. Any instance running an older version of the application is affected, regardless of the deployment environment.

The CVSS score of 7.1 indicates high severity. With no authentication required, an attacker only needs a valid session token from an ordinary user, which can be obtained by social engineering or credential reuse. The endpoint immediately yields a new organization and a usable API key, giving the attacker unrestricted API access. Because the exploit does not rely on local privileges or further access, the risk for organizations is significant, even though the EPSS score is not available and the vulnerability is not yet listed in the CISA KEV catalog.