CVE-2026-48783

Name of the Vulnerable Software and Affected Versions Postiz versions prior to 2.21.8

Description Postiz contains an unauthenticated billing-enforcement bypass. The endpoint '/public/modify-subscription' accepts a signed token and applies subscription-enforcement side effects to the organization referenced in the token's claims without verifying the token's intended purpose. While the persisted subscription tier cannot be changed, the issue allows the execution of enforcement-related side effects on the caller's own organization. These effects include adjusting team-member enablement state, disabling integrations that exceed the asserted plan's limits, and resetting the scheduled-post cron when the asserted plan is the free tier. The impact is limited to the attacker's own organization and cannot be redirected to other tenants.

Recommendations Update to version 2.21.8. As a temporary workaround, restrict access to the '/public/modify-subscription' endpoint.