CVE-2026-48799

Deferred Deferred - Pending Action

Postiz Improper IPN Verification Leads to Arbitrary PRO Subscriptions

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Postiz is an AI social media scheduling tool. Prior to 2.21.8, Postiz fails to verify Nowpayments IPN callback authenticity against the payment provider shared secret and reads the target subscription identifier from the untrusted request body, allowing a low-privileged account to grant arbitrary organizations lifetime PRO subscriptions without payment. This issue is fixed in version 2.21.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-15

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-48799

EUVD

EUVD-2026-44712

Affected Vendors & Products

Vendor	Product	Version / Range
gitroomhq	postiz	2.21.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

CVE-2026-48799 is a vulnerability in Postiz, an AI social media scheduling tool. It allows a low-privileged user to grant themselves a lifetime PRO subscription to any organization without payment. The issue occurs because the payment system fails to verify callback authenticity from Nowpayments and reads subscription IDs from untrusted request bodies.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized PRO subscriptions or suspicious Nowpayments IPN callbacks. Review application logs for unexpected subscription upgrades or unrecognized payment notifications. Check if the Nowpayments integration is still active in the codebase or if endpoints like /crypto or billing-related routes exist.

Impact Analysis

If you are a Postiz user, this vulnerability could allow attackers to gain unauthorized PRO subscriptions without payment, potentially leading to financial losses for the service provider. If you are an organization owner, an attacker could grant your organization a lifetime PRO subscription without your knowledge or payment. If you are the service operator, this could result in revenue loss due to unauthorized free upgrades and potential billing integrity issues.

Compliance Impact

This vulnerability primarily impacts billing integrity and revenue, not data privacy or security. It does not directly expose user data or violate GDPR/HIPAA requirements related to data protection. However, financial misreporting due to unauthorized subscriptions could indirectly affect compliance.

Mitigation Strategies

Upgrade Postiz to version 2.21.8 or later immediately. Remove all Nowpayments-related code, dependencies, and endpoints from the application. Verify that the billing controller no longer processes untrusted subscription identifiers from request bodies. Ensure JWT authentication middleware re-resolves user data from the database instead of trusting claims directly from tokens.

Hi! I’m here to help you understand CVE-2026-48799. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70