CVE-2026-48783 Details
Description
Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated endpoint that accepted a signed token and applied subscription-enforcement side effects to the organization referenced in that token's claims, without verifying the token's intended purpose. The endpoint, /public/modify-subscription, could not change the persisted subscription tier, but it did execute enforcement-related side effects on the caller's own organization, including adjusting team-member enablement state, disabling integrations exceeding the asserted plan's limits, and resetting the scheduled-post cron when the asserted plan was the free tier. Impact is limited to the attacker's own organization and cannot be redirected at other tenants through this endpoint. This issue has been fixed in version 2.21.8.
A vulnerability exists in Postiz, an AI social media scheduling tool, in versions prior to 2.21.8. The issue involves an unauthenticated endpoint, /public/modify-subscription, which accepted signed tokens and applied subscription-related effects to the organization mentioned in the token's claims. However, the endpoint did not verify the token's intended purpose. While it couldn't change the saved subscription tier, it did implement enforcement-related effects on the caller's organization. This included modifying team member access, disabling integrations that exceeded the limits of the claimed subscription plan, and resetting the scheduled post cron for users on the free tier. The vulnerability only affected the caller's organization and could not be used to target other organizations.
Users are advised to upgrade to Postiz version 2.21.8 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 17, 2026CISA-ADP
Assessed Jun 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gadvisory.org/advisories/PSA-2026-WWFR8X | [email protected] | Advisory |
| https://github.com/gitroomhq/postiz-app/commit/23696d2973510ae1f3f48bfa41a6bfbbf9827b05 | [email protected] | Source CodeVendor |
| https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.8 | [email protected] | Release NotesVendor |
| https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-v4wr-4j8g-4hfj | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
| CWE-749 | Exposed Dangerous Method or Function | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| GitroomHQ Postiz | >= 0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | New CVE Received | [email protected] |