Nedu-M

**Name of the Vulnerable Software and Affected Versions** Postiz versions prior to 2.21.8 **Description** An issue in the Skool integration callback allows the application to sign an attacker-controlled JSON blob into a session-shape JSON Web Token (JWT) using the `JWT SECRET`. Because the authentication middleware trusts every claim in the JWT without re-verifying the user against the database, any authenticated user can forge a SUPERADMIN session. This enables the impersonation of arbitrary organizations and provides full access to all parts of the application, including registered users and the ability to post to the social media channels of victims linked to the instance. **Recommendations** Update to version 2.21.8.

**Name of the Vulnerable Software and Affected Versions** Postiz versions prior to 2.21.8 **Description** Postiz contains an unauthenticated billing-enforcement bypass. The endpoint '/public/modify-subscription' accepts a signed token and applies subscription-enforcement side effects to the organization referenced in the token's claims without verifying the token's intended purpose. While the persisted subscription tier cannot be changed, the issue allows the execution of enforcement-related side effects on the caller's own organization. These effects include adjusting team-member enablement state, disabling integrations that exceed the asserted plan's limits, and resetting the scheduled-post cron when the asserted plan is the free tier. The impact is limited to the attacker's own organization and cannot be redirected to other tenants. **Recommendations** Update to version 2.21.8. As a temporary workaround, restrict access to the '/public/modify-subscription' endpoint.