CVE-2026-48781: Postiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgery

Synopsis

This is an authentication bypass and privilege escalation vulnerability in Postiz, an AI social media scheduling application. The flaw is reachable over the network by any low-privilege authenticated user, with no victim interaction required, because the Skool OAuth callback signs attacker-controlled data into a JWT using the application's own secret, and the middleware blindly trusts all claims in that token without checking the database. A successful attacker forges a SUPERADMIN session, gains full administrative access to the instance, reads all registered user data, and can post to any connected social media channel on behalf of any organization. A patched-image rebuild at version 2.21.8 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable Skool callback endpoint must be reachable over the network; an attacker sends a crafted HTTP request to it from any internet-accessible or internal network position.

• AuthenticationRequired

  The attacker must hold a valid low-privilege Postiz account on the target instance; any standard registered user account is sufficient to trigger the callback and forge the JWT.

• Victim interactionNot required

  No action from any other user or administrator is needed; the attacker exploits the callback endpoint entirely on their own.

• Attack complexityDetail

  Exploit complexity is low: no race conditions, memory layout knowledge, or special environmental factors are required, making the attack reliable and repeatable.

Blast Radius

• Attacker reads all user records registered to the Postiz instance, including account details and session data across every tenant.
• Attacker gains full SUPERADMIN control over all organizations on the instance, overriding per-tenant access boundaries entirely.
• Attacker posts arbitrary content to any social media channel connected to the instance in the name of any user or organization.
• All three pillars of data security are fully compromised: confidentiality, integrity, and availability of the instance and its connected social accounts.