CVE-2026-48799 | Postiz is an AI social media scheduling tool. Prior to 2.21.… | CVSS 7.7 HIGH

Description

Postiz is an AI social media scheduling tool. Prior to 2.21.8, Postiz fails to verify Nowpayments IPN callback authenticity against the payment provider shared secret and reads the target subscription identifier from the untrusted request body, allowing a low-privileged account to grant arbitrary organizations lifetime PRO subscriptions without payment. This issue is fixed in version 2.21.8.

Metadata

CVE ID: CVE-2026-48799
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-05-22 20:18 UTC
Published: 2026-07-15 16:11 UTC
Last updated: 2026-07-15 18:01 UTC
Primary CWE: CWE-345
CWE-345: Insufficient Verification of Data Authenticity
Vendor / Product: gitroomhq / postiz-app
Sources: cve.org · NVD

Severity & Metrics

7.7 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
gitroomhq	postiz-app	—	< 2.21.8

Weakness (CWE)

CWE	Source	Description
CWE-345	cna	CWE-345: Insufficient Verification of Data Authenticity
CWE-639	cna	CWE-639: Authorization Bypass Through User-Controlled Key

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.7	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

References (4)

https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-j7rp-5mgj-qgg9 https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-j7rp-5mgj-qgg9
https://github.com/gitroomhq/postiz-app/commit/23696d2973510ae1f3f48bfa41a6bfbbf9827b05 https://github.com/gitroomhq/postiz-app/commit/23696d2973510ae1f3f48bfa41a6bfbbf9827b05
https://gadvisory.org/advisories/PSA-2026-Q3TCPK https://gadvisory.org/advisories/PSA-2026-Q3TCPK
https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.8 https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.8