CVE-2026-107761: Postiz Information Disclosure Vulnerability

CVE-2026-107761 Overview

CVE-2026-107761 affects the Postiz social media management application. Several Postiz endpoints return complete database rows instead of only the fields the client needs. Two of these endpoints expose secrets the caller is not meant to receive.

The public API channel delete endpoint returns the deleted integration row, including the channel's platform access token and refresh token. The GET /user/organizations endpoint returns each organization row, including its API key, to every member of the organization. Both endpoints require a valid session, API key, or OAuth token and are scoped to the caller's own organization. The weakness is tracked as [CWE-201: Insertion of Sensitive Information Into Sent Data].

Critical Impact
A third-party OAuth app with channel delete permission receives social platform credentials and can abuse them outside Postiz. Lower-role organization members can obtain the admin-only API key and act on behalf of the organization.

Affected Products

Postiz (gitroomhq/postiz-app) prior to v2.25.1
Postiz public API channel delete endpoint
Postiz GET /user/organizations endpoint

Discovery Timeline

2026-10-11 - CVE-2026-107761 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-107761

Vulnerability Analysis

The vulnerability stems from two Postiz endpoints returning full Prisma ORM entities instead of projected view models. The channel delete handler returns the complete integration row after deletion. That row contains the platform access token and refresh token used to authenticate against the connected social network.

An OAuth-authorized third-party app with delete scope therefore receives working platform credentials. The attacker can post, read, or modify content on the connected social account directly against the social provider, bypassing Postiz entirely.

The GET /user/organizations endpoint returns each organization record with its apiKey field attached. Postiz treats the organization API key as an admin credential that grants full public API access. Any organization member, including users assigned lower-privileged roles, receives this key on each call and can escalate to admin-equivalent API capabilities.

Root Cause

Both handlers lacked explicit field selection on their database queries. The repository returned the full ORM entity, and the controllers serialized it directly to JSON. There was no response DTO mapping to strip sensitive fields such as token material or the organization API key.

Attack Vector

Exploitation requires an authenticated caller within the target organization. For the channel delete path, the attacker needs an OAuth app or API session with permission to delete a channel. For the organization leak, any authenticated member of the organization can call the endpoint. There is no anonymous access and no cross-tenant exposure.

typescript

// Patch: apps/backend/src/api/routes/users.controller.ts
@Get('/organizations')
async getOrgs(@GetUserFromRequest() user: User) {
-  return (await this._orgService.getOrgsByUserId(user.id)).filter(
-    (f) => !f.users[0].disabled
-  );
+  return (await this._orgService.getOrgsByUserId(user.id))
+    .filter((f) => !f.users[0].disabled)
+    .map((p) => ({
+      id: p.id,
+      name: p.name,
+      users: p.users,
+      subscription: p.subscription,
+    }));
}

typescript

// Patch: libraries/nestjs-libraries/src/database/prisma/integrations/integration.repository.ts
deleteChannel(org: string, id: string) {
  return this._integration.model.integration.update({
+   select: {
+     id: true,
+   },
    where: {
      id,
      organizationId: org,

Source: GitHub Commit 8ad0df3

Detection Methods for CVE-2026-107761

Indicators of Compromise

HTTP responses from DELETE channel endpoints containing fields such as accessToken, refreshToken, or token beyond the deleted record identifier.
Responses from GET /user/organizations that include an apiKey field in the organization object.
Public API calls authenticated with an organization API key originating from a user account that holds a non-admin role.
Outbound activity on connected social platforms sourced from IPs that never previously authenticated against those accounts.

Detection Strategies

Inspect reverse proxy or API gateway logs for Postiz responses whose JSON bodies include token or API key field names.
Correlate Postiz audit events for channel deletion with subsequent social platform API usage outside Postiz infrastructure.
Monitor for role mismatches: public API calls from accounts that should not possess the organization API key.

Monitoring Recommendations

Enable Postiz request and response logging in front of the application and alert on sensitive field names in response bodies.
Track issuance and rotation of organization API keys and flag any key observed in use by a non-admin member.
Review OAuth app grants and revoke any third-party integrations that are no longer required.

How to Mitigate CVE-2026-107761

Immediate Actions Required

Upgrade Postiz to version v2.25.1 or later, which restricts the fields returned by both affected endpoints.
Rotate every organization API key that existed before the upgrade, since lower-role members may already hold copies.
Revoke and reissue platform access tokens and refresh tokens for any social channel that was deleted while the vulnerable version was deployed.
Audit OAuth third-party apps authorized against Postiz and remove any that are untrusted or unused.

Patch Information

The fix is included in Postiz release v2.25.1. The patch adds explicit field selection in the integration repository and maps organization responses through a projection that omits the apiKey field. Full technical details are documented in the Gadvisory Security Advisory PSA-2026-4QX1WG and the GitHub commit 8ad0df3.

Workarounds

Restrict Postiz OAuth app permissions so that no third-party integration holds channel delete scope until the upgrade is applied.
Limit organization membership to trusted administrators until the API key leak is resolved by the patch.
Place an API gateway in front of Postiz that strips accessToken, refreshToken, and apiKey fields from outbound JSON responses as a temporary control.

bash

# Upgrade Postiz to the patched release
git fetch --tags
git checkout v2.25.1
# For Docker deployments
docker pull ghcr.io/gitroomhq/postiz-app:v2.25.1
docker compose up -d