PT-2026-60225 · Postiz · Postiz
CVE-2026-48799
·
Published
2026-07-15
·
Updated
2026-07-15
CVSS v3.1
7.7
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Postiz versions prior to 2.21.8
Description
Postiz fails to verify the authenticity of Nowpayments IPN (Instant Payment Notification) callbacks against the shared secret provided by the payment provider. Additionally, the application reads the target subscription identifier from the untrusted request body. This allows a low-privileged account to grant lifetime PRO subscriptions to arbitrary organizations without completing a payment.
Recommendations
Update to version 2.21.8.
Exploit
Fix
Insufficient Verification of Data Authenticity
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Postiz