CVE-2026-48783

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48783", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-22T20:18:20.365Z", "datePublished": "2026-06-16T21:38:00.674Z", "dateUpdated": "2026-06-17T12:43:39.751Z"}, "containers": {"cna": {"title": "Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription", "problemTypes": [{"descriptions": [{"cweId": "CWE-345", "lang": "en", "description": "CWE-345: Insufficient Verification of Data Authenticity", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-749", "lang": "en", "description": "CWE-749: Exposed Dangerous Method or Function", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-v4wr-4j8g-4hfj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-v4wr-4j8g-4hfj"}, {"name": "https://github.com/gitroomhq/postiz-app/commit/23696d2973510ae1f3f48bfa41a6bfbbf9827b05", "tags": ["x_refsource_MISC"], "url": "https://github.com/gitroomhq/postiz-app/commit/23696d2973510ae1f3f48bfa41a6bfbbf9827b05"}, {"name": "https://gadvisory.org/advisories/PSA-2026-WWFR8X", "tags": ["x_refsource_MISC"], "url": "https://gadvisory.org/advisories/PSA-2026-WWFR8X"}, {"name": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.8", "tags": ["x_refsource_MISC"], "url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.8"}], "affected": [{"vendor": "gitroomhq", "product": "postiz-app", "versions": [{"version": "< 2.21.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-16T21:38:00.674Z"}, "descriptions": [{"lang": "en", "value": "Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated endpoint that accepted a signed token and applied subscription-enforcement side effects to the organization referenced in that token's claims, without verifying the token's intended purpose. The endpoint, /public/modify-subscription, could not change the persisted subscription tier, but it did execute enforcement-related side effects on the caller's own organization, including adjusting team-member enablement state, disabling integrations exceeding the asserted plan's limits, and resetting the scheduled-post cron when the asserted plan was the free tier. Impact is limited to the attacker's own organization and cannot be redirected at other tenants through this endpoint. This issue has been fixed in version 2.21.8."}], "source": {"advisory": "GHSA-v4wr-4j8g-4hfj", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-17T12:43:27.137971Z", "id": "CVE-2026-48783", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-17T12:43:39.751Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48783", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-17T12:43:27.137971Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-17T12:43:29.893Z"}}], "cna": {"title": "Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription", "source": {"advisory": "GHSA-v4wr-4j8g-4hfj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "gitroomhq", "product": "postiz-app", "versions": [{"status": "affected", "version": "< 2.21.8"}]}], "references": [{"url": "https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-v4wr-4j8g-4hfj", "name": "https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-v4wr-4j8g-4hfj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/gitroomhq/postiz-app/commit/23696d2973510ae1f3f48bfa41a6bfbbf9827b05", "name": "https://github.com/gitroomhq/postiz-app/commit/23696d2973510ae1f3f48bfa41a6bfbbf9827b05", "tags": ["x_refsource_MISC"]}, {"url": "https://gadvisory.org/advisories/PSA-2026-WWFR8X", "name": "https://gadvisory.org/advisories/PSA-2026-WWFR8X", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.8", "name": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.8", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated endpoint that accepted a signed token and applied subscription-enforcement side effects to the organization referenced in that token's claims, without verifying the token's intended purpose. The endpoint, /public/modify-subscription, could not change the persisted subscription tier, but it did execute enforcement-related side effects on the caller's own organization, including adjusting team-member enablement state, disabling integrations exceeding the asserted plan's limits, and resetting the scheduled-post cron when the asserted plan was the free tier. Impact is limited to the attacker's own organization and cannot be redirected at other tenants through this endpoint. This issue has been fixed in version 2.21.8."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-345", "description": "CWE-345: Insufficient Verification of Data Authenticity"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-749", "description": "CWE-749: Exposed Dangerous Method or Function"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-16T21:38:00.674Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48783", "state": "PUBLISHED", "dateUpdated": "2026-06-17T12:43:39.751Z", "dateReserved": "2026-05-22T20:18:20.365Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-16T21:38:00.674Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "postiz-app", "vendor": "gitroomhq", "versions": [{"status": "affected", "version": "< 2.21.8"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated endpoint that accepted a signed token and applied subscription-enforcement side effects to the organization referenced in that token's claims, without verifying the token's intended purpose. The endpoint, /public/modify-subscription, could not change the persisted subscription tier, but it did execute enforcement-related side effects on the caller's own organization, including adjusting team-member enablement state, disabling integrations exceeding the asserted plan's limits, and resetting the scheduled-post cron when the asserted plan was the free tier. Impact is limited to the attacker's own organization and cannot be redirected at other tenants through this endpoint. This issue has been fixed in version 2.21.8."}, {"lang": "es", "value": "Postiz es una herramienta de programaci\u00f3n de redes sociales con IA. Las versiones anteriores a la 2.21.8 conten\u00edan un endpoint no autenticado que aceptaba un token firmado y aplicaba efectos secundarios de aplicaci\u00f3n de suscripci\u00f3n a la organizaci\u00f3n referenciada en las declaraciones de ese token, sin verificar el prop\u00f3sito previsto del token. El endpoint, /public/modify-subscription, no pod\u00eda cambiar el nivel de suscripci\u00f3n persistido, pero s\u00ed ejecutaba efectos secundarios relacionados con la aplicaci\u00f3n en la propia organizaci\u00f3n del llamador, incluyendo el ajuste del estado de habilitaci\u00f3n de los miembros del equipo, la deshabilitaci\u00f3n de integraciones que exced\u00edan los l\u00edmites del plan declarado, y el restablecimiento del cron de publicaciones programadas cuando el plan declarado era el nivel gratuito. El impacto se limita a la propia organizaci\u00f3n del atacante y no puede ser redirigido a otros inquilinos a trav\u00e9s de este endpoint. Este problema ha sido solucionado en la versi\u00f3n 2.21.8."}], "id": "CVE-2026-48783", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48783", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-17T12:43:27.137971Z", "version": "2.0.3"}}]}, "published": "2026-06-17T13:20:43.353", "references": [{"source": "security-advisories@github.com", "url": "https://gadvisory.org/advisories/PSA-2026-WWFR8X"}, {"source": "security-advisories@github.com", "url": "https://github.com/gitroomhq/postiz-app/commit/23696d2973510ae1f3f48bfa41a6bfbbf9827b05"}, {"source": "security-advisories@github.com", "url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.8"}, {"source": "security-advisories@github.com", "url": "https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-v4wr-4j8g-4hfj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-345"}, {"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-749"}, {"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.21.8)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "postiz-app", "source": "cna", "vendor": "gitroomhq"}, "product": "postiz-app", "vendor": "gitroomhq"}], "created": "2026-06-17T01:30:04.922110+00:00", "updated": "2026-06-17T18:45:10.829188+00:00", "vendors": ["gitroomhq", "gitroomhq$PRODUCT$postiz-app"]}