Critical JWT Forgery Flaw in Postiz Enables SUPERADMIN Takeover
Vulnerability Disclosure · 4 sources · Updated 4mo ago · First seen Jun 17, 2026
A critical vulnerability in Postiz allows any authenticated user to escalate privileges to SUPERADMIN by forging JWTs through the application's Skool integration callback. Tracked as CVE-2026-48781 and GHSA-j77w-h625-56q2, the flaw stems from attacker-controlled JSON being signed into a session-like token with the application's JWT_SECRET, while authentication logic trusted the token's claims without reloading the user record from the database.
The bug affects Postiz versions prior to 2.21.8 and enables cross-tenant takeover, arbitrary organization impersonation, full access across the affected instance, exposure of all registered users, and the ability to post through victims' connected social media accounts. The issue is rated CVSS 9.9 (Critical), was verified and patched by the vendor, and defenders are advised to upgrade to 2.21.8, rotate JWT secrets if compromise is suspected, and review logs for impersonation or unauthorized access activity.
