Login Request a demo
High severity · published Jul 15, 2026
CVE-2026-48799
Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook
7.7
CVSS
0.2%
EPSS
No
On KEV
Description
Postiz is an AI social media scheduling tool. Prior to 2.21.8, Postiz fails to verify Nowpayments IPN callback authenticity against the payment provider shared secret and reads the target subscription identifier from the untrusted request body, allowing a low-privileged account to grant arbitrary organizations lifetime PRO subscriptions without payment. This issue is fixed in version 2.21.8.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
postiz-app · gitroomhq
< 2.21.8 · source: vendor
Affected product
PO
postiz-app
gitroomhq
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-48799
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-48799
gadvisory.org
https://gadvisory.org/advisories/PSA-2026-Q3TCPK
github.com
https://github.com/gitroomhq/postiz-app/commit/23696d2973510ae1f3f48bfa41a6bfbbf9827b05
github.com
https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.8
github.com
https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-j7rp-5mgj-qgg9
More from postiz-app
9.9
CVE-2026-115933
Forged signed tokens let any registered user take over other users and organizations
9.9
CVE-2026-115931
Arbitrary file read and backend crash through unrestricted provider method calls
9.9
CVE-2026-48781
Postiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgery
9.8
CVE-2026-19264
Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover
9.8
CVE-2026-42298
Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev