Forged signed tokens let any registered user take over other users and organizations

Arbitrary file read and backend crash through unrestricted provider method calls

Postiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgery

Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev

Path traversal in post media lets any registered user read server files

Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys

Postiz stored XSS in public preview page

Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS