Loading story…
A critical vulnerability in Postiz allows any authenticated user to escalate privileges to SUPERADMIN by forging JWTs through the application's Skool integration callback. Tracked as CVE-2026-48781 and GHSA-j77w-h625-56q2, the flaw stems from attacker-controlled JSON being signed into a session-like token with the application's JWT_SECRET, while authentication logic trusted the token's claims without reloading the user record from the database.
The bug affects Postiz versions prior to 2.21.8 and enables cross-tenant takeover, arbitrary organization impersonation, full access across the affected instance, exposure of all registered users, and the ability to post through victims' connected social media accounts. The issue is rated CVSS 9.9 (Critical), was verified and patched by the vendor, and defenders are advised to upgrade to 2.21.8, rotate JWT secrets if compromise is suspected, and review logs for impersonation or unauthorized access activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Postiz verified a privilege-escalation vulnerability in the Skool integration callback and produced a fix on 2026-05-22. The issue was patched in Postiz version 2.21.8, with no workaround other than upgrading.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcegadvisory.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Siemens disclosed **CVE-2026-56451**, a critical authentication-bypass vulnerability in **Opcenter X** caused by improper validation of the algorithm specified in a JSON Web Token (**JWT**) header. The flaw affects **all versions earlier than `V2604`** and allows an **unauthenticated remote attacker** to forge arbitrary JWTs, bypass authentication, impersonate any user including administrators, and potentially obtain full unauthorized access to the application. The issue is classified as **CWE-347** and was assigned a **CVSS v3.1 vector** of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with reporting indicating a **maximum severity score of 10.0** under both CVSS 3.1 and 4.0. Siemens identified **`V2604`** as the remediation release through its ProductCERT advisory, and no active exploitation was reported at disclosure, although the attack class is considered highly exploitable because JWT algorithm confusion techniques are well known and broadly tooled.
Jul 16, 2026
A **critical authentication bypass** in the Cal.com open-source scheduling platform allows remote attackers to **hijack arbitrary user accounts** by abusing a flaw in a custom *NextAuth* JWT callback used during session updates. Tracked as **CVE-2026-23478** (reported as **CVSS 10.0**), the issue affects Cal.com versions **>= 3.1.6 and < 6.0.7** and is exploitable over the network with minimal prerequisites—primarily knowledge of a victim’s email address. The weakness occurs when the session trigger is set to `"update"`, where Cal.com improperly accepts **client-controlled identity fields** and writes them into the JWT without server-side validation (mapped to issues such as **CWE-602** and **CWE-639**). An attacker can send a single API call like `session.update({ email: "victim@example.com" })` to produce a manipulated token that retains the attacker’s `sub` but swaps in the victim’s email; subsequent requests are treated as the victim because the application looks up users using the attacker-controlled `token.email` field. Successful exploitation yields full access to victim data and capabilities (bookings, event types, integrations, org membership, billing, and potentially admin privileges), and **2FA/external IdP associations do not mitigate** because the compromise occurs at the session token level; **Cal.com 6.0.7+** is cited as containing the fix.
Jun 29, 2026
A critical vulnerability tracked as **CVE-2026-56271** allows remote attackers to bypass authentication in **Flowise** by forging valid JWTs and impersonating arbitrary users, including administrators. The flaw affects versions before **3.1.0**, including **3.0.13** and earlier, and stems from weak hardcoded default JWT secrets plus default audience and issuer values in the enterprise passport authentication middleware. When the relevant JWT environment variables are not explicitly configured, Flowise falls back to publicly known defaults, effectively embedding insecure default credentials into the authentication path. The issue is rated **CVSS v3.1 9.8** and **CVSS v4.0 9.3** as remotely exploitable, and remediation guidance calls for upgrading to **Flowise 3.1.0 or later** and setting strong, unique JWT secrets along with custom audience and issuer values.
Jul 18, 2026