CVE-2026-48783: Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription

Vulnerability summary

CVE-2026-48783 is a medium (CVSS 4.8) vulnerability in gitroomhq postiz-app. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.5% of scored vulnerabilities.

Timeline

1. 16-06-2026
   PublishedVulnerability first disclosed.
2. 17-06-2026
   Last modifiedVulnerability information updated.

Description

Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated endpoint that accepted a signed token and applied subscription-enforcement side effects to the organization referenced in that token's claims, without verifying the token's intended purpose. The endpoint, /public/modify-subscription, could not change the persisted subscription tier, but it did execute enforcement-related side effects on the caller's own organization, including adjusting team-member enablement state, disabling integrations exceeding the asserted plan's limits, and resetting the scheduled-post cron when the asserted plan was the free tier. Impact is limited to the attacker's own organization and cannot be redirected at other tenants through this endpoint. This issue has been fixed in version 2.21.8.

• CWE-345Insufficient Verification of Data AuthenticityThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
• CWE-749Exposed Dangerous Method or FunctionThe product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.