GitroomHQ has 6 CVEs on record. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 4. The median CVSS is 9.3 (critical), with 4 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 9.3
- Publish → KEV
- —
- Last 90 days
- 6 prev 0
Weakness classes
Products
- postiz-app 6
Worst active — by depth score
CVE-2026-115931Critical· 9.9Arbitrary file read and backend crash through unrestricted provider method calls55CVE-2026-115933Critical· 9.9Forged signed tokens let any registered user take over other users and organizations54CVE-2026-115932Critical· 9.6Path traversal in post media lets any registered user read server files53CVE-2026-94456Critical· 9.1Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source50CVE-2026-94455High· 7.1An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session39
GitroomHQ vulnerabilities
CVEs affecting GitroomHQ, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-115933Critical· 9.9Forged signed tokens let any registered user take over other users and organizations
Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request…
CVE-2026-115932Critical· 9.6Path traversal in post media lets any registered user read server files
When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a …
CVE-2026-115931Critical· 9.9Arbitrary file read and backend crash through unrestricted provider method calls
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be …
CVE-2026-107761Medium· 5.3Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs
Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the caller is not meant to receive. The public API's channel delete returns…
CVE-2026-94456Critical· 9.1Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source
Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE ver…
CVE-2026-94455High· 7.1An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session
An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on th…