CVE-2026-42298
A vulnerability in the Postiz social media scheduling tool allows an attacker to run unauthorized code during the software's build process. By submitting a specially crafted pull request, an attacker can steal highly privileged access tokens.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users and developers of the Postiz AI social media scheduling tool.
Real-world impact
An attacker could gain full control over the project's GitHub repository by stealing a high-privilege token, allowing them to modify the software or access sensitive data.
Why this severity
This is a critical vulnerability because it can be exploited remotely without any user interaction or authentication, and it allows for complete compromise of the system's security credentials.
What to do about it
- 01Update Postiz to the version containing commit da44801 or later.
NVD-referenced vendor advisory
Timeline
- May 8, 2026 · May 8, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
- Jul 26, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- github.com/gitroomhq/postiz-app/commit…url repurposed
- github.com/gitroomhq/postiz-app/securi…vendor advisory