gitroomhq vulnerabilities
20 published CVEs name gitroomhq among the affected products.
- 20Published CVEs20 of them scored
- 19Last 12 monthspublished in the last year
- 7Critical8 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-115933
Forged signed tokens let any registered user take over other users and organizations
GitroomHQ · postiz-app
Critical9.9 - CVE-2026-115932
Path traversal in post media lets any registered user read server files
GitroomHQ · postiz-app
Critical9.6 - CVE-2026-115931
Arbitrary file read and backend crash through unrestricted provider method calls
GitroomHQ · postiz-app
Critical9.9 - CVE-2026-107761
Channel tokens and organization API key exposed in API responses
GitroomHQ · postiz-app
Medium5.3 - CVE-2026-94455
Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key
GitroomHQ · postiz-app
High7.1 - CVE-2026-94456
Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys
GitroomHQ · postiz-app
Critical9.1 - CVE-2026-19264
Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover
gitroomhq · postiz-app
Critical9.3 - CVE-2026-19127
Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions
GitroomHQ · postiz-app
Medium6.5 - CVE-2026-48799
Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook
gitroomhq · postiz-app
High7.7 - CVE-2026-48783
Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription
gitroomhq · postiz-app
Medium4.8