Vulnerability · CVE-2026-107761
Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs.
Published Oct 11, 2026 · catalog updated Oct 15, 2026 · Several Postiz endpoints return
Check if you run it
No confirmed exploitation is on record for CVE-2026-107761. EPSS is 0.28%. Act only if a listed version of Several Postiz endpoints return is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (Several Postiz endpoints return).
- No version range is stored. A customer cannot check an installed version against this record.
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- Medium5.3
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.28%
- Remediation
- Advisory link
- Affected products
- See sources for product scope
Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the caller is not meant to receive. The public API's channel delete returns the deleted integration row, including the channel's platform access token and refresh token. A third-party OAuth app permitted to delete a channel therefore receives that channel's social platform credentials and can use them against the connected account directly, outside Postiz. returns each organization row, including its API key, to every member of the organization. The API key is intended for admins only, so a member with a lower role can obtain it and call the public API on behalf of the organization. Both endpoints require a valid session, API key or OAuth token and are scoped to the caller's own organization. There is no anonymous access and no cross-tenant exposure.
No affected version ranges are stored yet. Use the vendor advisory before you decide this record does not apply.
How to fix CVE-2026-107761
Recommended remediation
A patch or advisory reference is linked. Open the original publisher for availability by product version.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-107761. EPSS is 0.28%. Act only if a listed version of Several Postiz endpoints return is installed.
Which versions are affected?
Affected version ranges are not on this record. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-201; CWE-213. EPSS 0.28%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 11, 2026 · NIST NVD
Detected
Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the caller is not meant to receive. The public API's channel delete returns the deleted integration row, including the channel's platform access token and refresh token. A third-party OAuth app permitted to delete a channel therefore recei
Oct 15, 2026 · NIST NVD
Updated
Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the caller is not meant to receive. The public API's channel delete returns the deleted integration row, including the channel's platform access token and refresh token. A third-party OAuth app permitted to delete a channel therefore recei
Oct 15, 2026 · NIST NVD
Updated
Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the caller is not meant to receive. The public API's channel delete returns the deleted integration row, including the channel's platform access token and refresh token. A third-party OAuth app permitted to delete a channel therefore recei
Sources
- CVE.orgVulnerability recordCVE-2026-107761
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-107761
30-day exploitation probability 0.3%
first.org - NIST NVDVulnerability recordCVE-2026-107761
Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the caller is not meant to receive. The public API's channel delete returns the deleted integration row, including the
nvd.nist.gov
References
Freshness
Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.