Postiz
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 11 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from July 11, 2025 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →Arbitrary file read and backend crash through unrestricted provider method calls
Channel tokens and organization API key exposed in API responses
Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys
Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription
Postiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgery
Postiz stored XSS in public preview page
Postiz: TOCTOU DNS rebinding bypasses all SSRF URL validation paths
Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev
Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS
Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream
Monitor Postiz in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.