Vulnerability · Published Jul 15, 2026 · Assigned by GitHub_M

CVE-2026-48799Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook

High 7.7

In plain English

A high-severity insufficient verification of data authenticity in postiz-app from gitroomhq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.2%top 87.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Postiz is an AI social media scheduling tool. Prior to 2.21.8, Postiz fails to verify Nowpayments IPN callback authenticity against the payment provider shared secret and reads the target subscription identifier from the untrusted request body, allowing a low-privileged account to grant arbitrary organizations lifetime PRO subscriptions without payment. This issue is fixed in version 2.21.8.

Affected products (as reported)

Vendor	Product	Versions
gitroomhq	postiz-app	< 2.21.8

Weakness: CWE-345, CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

References

https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-j7rp-5mgj-qgg9 x_refsource_CONFIRM
https://github.com/gitroomhq/postiz-app/commit/23696d2973510ae1f3f48bfa41a6bfbbf9827b05 x_refsource_MISC
https://gadvisory.org/advisories/PSA-2026-Q3TCPK x_refsource_MISC
https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.8 x_refsource_MISC