CVE-2026-48799 - Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook

Back Back to CVE browser

HIGH

Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook

Published Jul 15, 2026

7.7

HIGH

CVSS 3.1

EPSS 0.22%

Description

Postiz is an AI social media scheduling tool. Prior to 2.21.8, Postiz fails to verify Nowpayments IPN callback authenticity against the payment provider shared secret and reads the target subscription identifier from the untrusted request body, allowing a low-privileged account to grant arbitrary organizations lifetime PRO subscriptions without payment. This issue is fixed in version 2.21.8.

Affected products

Vendor Gitroomhq Product Postiz-App Default
n/a
- Version
  < 2.21.8
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Gitroomhq

Postiz-App

n/a

Version	Status	Constraints
< 2.21.8	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-345

CWE-639

Authorization Bypass

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44712
Advisory
https://gadvisory.org/advisories/PSA-2026-Q3TCPK
x_refsource_MISC
https://github.com/gitroomhq/postiz-app/commit/23696d2973510ae1f3f48bfa41a6bfbbf9827b05
x_refsource_MISC
https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.8
x_refsource_MISC
https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-j7rp-5mgj-qgg9
x_refsource_CONFIRM

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44712		Advisory
https://gadvisory.org/advisories/PSA-2026-Q3TCPK		x_refsource_MISC
https://github.com/gitroomhq/postiz-app/commit/23696d2973510ae1f3f48bfa41a6bfbbf9827b05		x_refsource_MISC
https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.8		x_refsource_MISC
https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-j7rp-5mgj-qgg9		x_refsource_CONFIRM