GitroomHQ vulnerabilities
We track 15 vulnerabilities in GitroomHQ products. 15 are rated high or critical, and none are known to be exploited. The most recent was published on October 24, 2026.
Latest GitroomHQ vulnerabilities
- 9.9 Critical severity
postiz-app: Authentication Bypass by Spoofing
Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the
- 9.6 Critical severity
postiz-app: Improper Limitation of a Pathname to a Restricted Directory
When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the c
- 9.9 Critical severity
postiz-app: External Control of File Name or Path
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web
- 9.1 Critical severity
postiz-app: Use of Insufficiently Random Values
Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these c
- 7.1 High severity
postiz-app: Missing Authentication for Critical Functionality
An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authenti
- 9.8 Critical severity
postiz-app: Improper Limitation of a Pathname to a Restricted Directory
Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requ
- 7.7 High severity
postiz-app: Insufficient Verification of Data Authenticity
Postiz is an AI social media scheduling tool. Prior to 2.21.8, Postiz fails to verify Nowpayments IPN callback authenticity against the payment provider shared secret and reads the target subscription identifier from the untrusted request body, allowing a low-
- 9.9 Critical severity
postiz-app: Authentication Bypass by Assumed-Immutable Data
Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, the Skool integration callback signed an attacker-controlled JSON blob into a session-shape JWT using the application's JWT_SECRET, and the auth middleware trusted every claim in that J
- 9.0 Critical severity
postiz-app: Improper Neutralization of Input During Web Page Generation
Postiz is an AI social media scheduling tool. From version 2.21.6 to before version 2.21.7, any authenticated user who can create a post can store arbitrary HTML in post content by tampering their own save request and send the public preview link /p/<postId>?s
- 9.8 Critical severity
postiz-app: Improper Control of Generation of Code
Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow (.github/workflows/pr-docker-build.yml) allows any unauthenticated user to execute arbitrary code during the
- 9.0 Critical severity
postiz-app: Improper Neutralization of Input During Web Page Generation
Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the `Content-Type` header. The uploaded
- 8.2 High severity
postiz-app: Server-Side Request Forgery
Postiz is an AI social media scheduling tool. Prior to 2.21.5, the /api/public/stream endpoint is vulnerable to SSRF. Although the application validates the initially supplied URL and blocks direct private/internal hosts, it does not re-validate the final dest
- 8.6 High severity
postiz-app: Server-Side Request Forgery
Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the GET /public/stream endpoint in PublicController accepts a user-supplied url query parameter and proxies the full HTTP response back to the caller. The only validation is url.endsWith('m
- 7.7 High severity
postiz-app: Server-Side Request Forgery
Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the POST /public/v1/upload-from-url endpoint accepts a user-supplied URL and fetches it server-side using axios.get() with no SSRF protections. The only validation is a file extension check
- 8.2 High severity
postiz-app: Server-Side Request Forgery
Postiz is an AI social media scheduling tool. From 1.45.1 to 1.62.3, the Postiz frontend application allows an attacker to inject arbitrary HTTP headers into the middleware pipeline. This flaw enables a server-side request forgery (SSRF) condition, which can b