PT-2026-60225 · Gitroomhq · Postiz-App

Publicado 2026-07-15 · Atualizado 2026-07-15 · CVE-2026-48799

NVD

CVSS v3.1

7.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Postiz is an AI social media scheduling tool. Prior to 2.21.8, Postiz fails to verify Nowpayments IPN callback authenticity against the payment provider shared secret and reads the target subscription identifier from the untrusted request body, allowing a low-privileged account to grant arbitrary organizations lifetime PRO subscriptions without payment. This issue is fixed in version 2.21.8.

Correção

Insufficient Verification of Data Authenticity

IDOR

Enumeração de Fraquezas

CWE-345

CWE-639

Identificadores relacionados

CVE-2026-48799

Produtos afetados

Postiz-App

Referências · 5

• https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-j7rp-5mgj-qgg9 · Nota
• https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.8 · Nota
• https://github.com/gitroomhq/postiz-app/commit/23696d2973510ae1f3f48bfa41a6bfbbf9827b05 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-48799 · Nota de Segurança
• https://gadvisory.org/advisories/PSA-2026-Q3TCPK · Nota