Vulnerability · Published Aug 6, 2026 · Assigned by postiz
CVE-2026-19127Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions
Medium 6.5
In plain English
A medium-severity insufficient verification of data authenticity in postiz-app from GitroomHQ. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Official description
An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows. By exploiting insufficient cryptographic validation or lack of server-side state verification on promotional/lifetime-deal (LTD) redemption codes, an unauthenticated attacker can forge valid redemption tokens or replay existing single-use codes to activate permanent, tier-highest paid subscriptions without a financial transaction.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| GitroomHQ | postiz-app | 0 – before 2.21.10 |
Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N