CVE-2026-94455
Received Received - Intake

Authentication Bypass in Enterprise Provisioning Endpoint

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: postiz

Description
An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The endpoint's only check is that the request body carries a token bearing a valid signature from the instance secret. It does not check what that token was issued for. Login tokens are signed with the same secret and carry no purpose, audience or expiry claim, so an ordinary user's own session token satisfies the check. Presented with such a token, the endpoint creates a new organisation holding the highest subscription tier, flagged as lifetime and with a channel allowance far above any sold plan, creates an organisation-owner account alongside it, and returns the new organisation's API key in the response body. That key is immediately valid against the public API.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-94455
EUVD
EUVD-2026-84547

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gitroomhq postiz_app to 2.4.0 (exc)
gitroomhq postiz_app 2.24.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-1390 The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an unauthenticated user to create a privileged organization with the highest subscription tier by using a valid but unsigned session token. The endpoint lacks proper authentication checks, relying only on a token signature without verifying its purpose or scope.

Detection Guidance

Check for unauthorized organization creation or API key generation in logs. Monitor for requests to enterprise provisioning endpoints without valid session tokens.

Impact Analysis

An attacker could exploit this to create organizations with elevated privileges, potentially gaining control over resources, bypassing subscription limits, and accessing sensitive operations without proper authorization.

Compliance Impact

This vulnerability could lead to unauthorized access and privilege escalation, violating data protection principles in GDPR and HIPAA. It may result in unauthorized data exposure or modification, compromising compliance with access control and integrity requirements.

Mitigation Strategies

Restrict access to the enterprise provisioning endpoint by updating authentication middleware to include all controllers. Rotate instance secrets and invalidate all existing tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94455. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart