Forged signed tokens let any registered user take over other users and organizations

Arbitrary file read and backend crash through unrestricted provider method calls

Postiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgery

Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev

Path traversal in post media lets any registered user read server files

Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys

Postiz stored XSS in public preview page

Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS

Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check

Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream

Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook

Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata

Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key

Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions

Postiz: TOCTOU DNS rebinding bypasses all SSRF URL validation paths

Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation

Channel tokens and organization API key exposed in API responses

Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription