CVE-2026-48799

HIGH 7.7

Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook

CVSS Score

7.7

EPSS Score

0.0%

EPSS Percentile

0th

Postiz is an AI social media scheduling tool. Prior to 2.21.8, Postiz fails to verify Nowpayments IPN callback authenticity against the payment provider shared secret and reads the target subscription identifier from the untrusted request body, allowing a low-privileged account to grant arbitrary organizations lifetime PRO subscriptions without payment. This issue is fixed in version 2.21.8.

CWE	CWE-345 CWE-639
Vendor	gitroomhq
Product	postiz-app
Published	Jul 15, 2026
Last Updated	Jul 15, 2026

Stay Ahead of the Next One

Get instant alerts for gitroomhq postiz-app

Be the first to know when new high vulnerabilities affecting gitroomhq postiz-app are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

gitroomhq / postiz-app

< 2.21.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-j7rp-5mgj-qgg9 github.com: https://github.com/gitroomhq/postiz-app/commit/23696d2973510ae1f3f48bfa41a6bfbbf9827b05 gadvisory.org: https://gadvisory.org/advisories/PSA-2026-Q3TCPK github.com: https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.8