PT-2026-60225 · Gitroomhq · Postiz-App

Published 2026-07-15 · Updated 2026-07-15 · CVE-2026-48799

NVD

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Postiz is an AI social media scheduling tool. Prior to 2.21.8, Postiz fails to verify Nowpayments IPN callback authenticity against the payment provider shared secret and reads the target subscription identifier from the untrusted request body, allowing a low-privileged account to grant arbitrary organizations lifetime PRO subscriptions without payment. This issue is fixed in version 2.21.8.

Fix

Insufficient Verification of Data Authenticity

IDOR

Weakness Enumeration

CWE-345

CWE-639

Related Identifiers

CVE-2026-48799

Affected Products

Postiz-App

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-48799 · Security Note
• https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-j7rp-5mgj-qgg9 · Note
• https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.8 · Note
• https://github.com/gitroomhq/postiz-app/commit/23696d2973510ae1f3f48bfa41a6bfbbf9827b05 · Note
• https://gadvisory.org/advisories/PSA-2026-Q3TCPK · Note