Executive brief
Postiz, an AI-powered social media scheduling tool, contains a flaw in how it handles payment notifications from the Nowpayments service. An attacker with a standard user account can bypass the payment process to grant themselves or any other organization a lifetime 'PRO' subscription for free. This vulnerability results in direct revenue loss for the service operator by allowing unauthorized access to premium features without valid transactions.
Technical details
The vulnerability exists in the Nowpayments Instant Payment Notification (IPN) handler within Postiz. The application fails to validate the authenticity of incoming webhooks against the payment provider's shared secret, instead relying on a token signed with an internal key that any authenticated user can obtain. Furthermore, the handler extracts the target subscription identifier from the untrusted request body rather than a verified token. A remote attacker with low-privileged access can exploit this to specify an arbitrary organization as the target for a subscription upgrade, effectively bypassing the payment gateway. The issue is addressed in version 2.21.8 by implementing proper signature verification and data integrity checks.
Affected products
- gitroomhq postiz-app < 2.21.8
Timeline
- 2026-05-22: disclosed: Postiz received the advisory and verified the vulnerability.
- 2026-05-22: patched: Fix developed and released in version 2.21.8.
- 2026-05-23: advisory: GitHub Security Advisory published.
- 2026-07-15: advisory: NVD published the CVE record.