Postiz
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 9 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from July 11, 2025 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys
Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription
Postiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgery
Postiz stored XSS in public preview page
Postiz: TOCTOU DNS rebinding bypasses all SSRF URL validation paths
Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev
Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS
Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream
Postiz allows header mutation in middleware facilitates resulting in SSRF
Monitor Postiz in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.