CVE-2026-48799: Postiz Auth Bypass Vulnerability

CVE-2026-48799 Overview

Postiz is an AI-driven social media scheduling platform. Versions prior to 2.21.8 fail to verify the authenticity of Nowpayments Instant Payment Notification (IPN) callbacks against the payment provider shared secret. The application also reads the target subscription identifier directly from the untrusted request body. A low-privileged authenticated attacker can forge IPN callbacks and grant arbitrary organizations lifetime PRO subscriptions without submitting payment. The maintainers addressed the flaw in version 2.21.8. The weakness is classified under [CWE-345: Insufficient Verification of Data Authenticity].

Critical Impact
Any low-privileged Postiz account can bypass payment controls and upgrade arbitrary organizations to lifetime PRO subscriptions, resulting in revenue loss and integrity compromise of the billing system.

Affected Products

Postiz (gitroomhq/postiz-app) versions prior to 2.21.8
Postiz deployments integrated with Nowpayments as a payment provider
Self-hosted and managed Postiz installations exposing the billing webhook endpoint

Discovery Timeline

2026-07-15 - CVE-2026-48799 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-48799

Vulnerability Analysis

The vulnerability resides in the Postiz billing controller that processes Nowpayments IPN callbacks. Nowpayments signs each IPN payload using a shared secret, and integrating applications must validate the x-nowpayments-sig HMAC header before trusting request contents. Postiz omits this verification step entirely in versions before 2.21.8. The endpoint accepts unsigned callbacks and processes them as legitimate payment events.

Compounding the issue, the controller reads the subscription target identifier straight from the request body rather than resolving it from an authenticated server-side context. Attackers can therefore direct the fabricated payment confirmation at any organization identifier they choose. Combined with the missing signature check, this permits arbitrary account upgrades without any monetary transaction.

Root Cause

The root cause is missing cryptographic verification of webhook authenticity. The application trusts inbound HTTP requests to the billing IPN route without validating the HMAC signature Nowpayments attaches to each callback. Additionally, the handler uses attacker-controlled body fields to select the organization receiving the subscription grant, violating server-side authorization boundaries.

Attack Vector

An authenticated user with low privileges sends a crafted HTTP POST request to the Nowpayments IPN endpoint. The payload mimics a successful payment event and specifies a target organization identifier controlled by the attacker. Because Postiz does not compute or compare the expected HMAC against the provided signature, the request is accepted. The billing service then provisions a lifetime PRO subscription to the specified organization at no cost.

typescript

// Security patch in apps/backend/src/api/api.module.ts
 import { RootController } from '@gitroom/backend/api/routes/root.controller';
 import { TrackService } from '@gitroom/nestjs-libraries/track/track.service';
 import { ShortLinkService } from '@gitroom/nestjs-libraries/short-linking/short.link.service';
-import { Nowpayments } from '@gitroom/nestjs-libraries/crypto/nowpayments';
 import { WebhookController } from '@gitroom/backend/api/routes/webhooks.controller';
 import { SignatureController } from '@gitroom/backend/api/routes/signature.controller';
 import { AutopostController } from '@gitroom/backend/api/routes/autopost.controller';

// Security patch in apps/backend/src/api/routes/billing.controller.ts
 import { GetUserFromRequest } from '@gitroom/nestjs-libraries/user/user.from.request';
 import { NotificationService } from '@gitroom/nestjs-libraries/database/prisma/notifications/notification.service';
 import { Request } from 'express';
-import { Nowpayments } from '@gitroom/nestjs-libraries/crypto/nowpayments';
 import { AuthService } from '@gitroom/helpers/auth/auth.service';

// Source: https://github.com/gitroomhq/postiz-app/commit/23696d2973510ae1f3f48bfa41a6bfbbf9827b05
// The patch removes the vulnerable Nowpayments handler wiring from the billing pipeline.

Detection Methods for CVE-2026-48799

Indicators of Compromise

Organizations upgraded to lifetime PRO subscription tiers without corresponding Nowpayments transaction records in the provider dashboard.
Inbound POST requests to the Nowpayments IPN route lacking a valid x-nowpayments-sig header or containing signatures that fail HMAC verification against the shared secret.
Multiple subscription upgrade events sourced from IP addresses associated with authenticated low-privileged accounts.

Detection Strategies

Reconcile the Postiz subscription database against Nowpayments transaction logs to identify accounts upgraded without matching payments.
Enable verbose logging on the billing controller and alert on IPN callbacks that are processed without a preceding signature validation event.
Inspect web access logs for POST requests to /billing webhook routes originating from unexpected internal or authenticated user sessions.

Monitoring Recommendations

Monitor subscription-tier change events and correlate them with authenticated user identities and source IP addresses.
Configure alerts for anomalous spikes in PRO tier provisioning events, particularly outside normal business patterns.
Retain webhook request bodies and headers for forensic review to distinguish legitimate provider callbacks from forged submissions.

How to Mitigate CVE-2026-48799

Immediate Actions Required

Upgrade Postiz to version 2.21.8 or later without delay.
Audit all organization subscription records and revert any upgrades that cannot be tied to a verified Nowpayments transaction.
Rotate the Nowpayments shared IPN secret after upgrading to invalidate any credentials that may have been logged or exposed.

Patch Information

The fix is delivered in Postiz release v2.21.8. The remediation is implemented in commit 23696d2, which removes the vulnerable Nowpayments handler wiring from the backend billing pipeline. Refer to the GitHub Security Advisory GHSA-j7rp-5mgj-qgg9 and the Gadvisory Security Advisory PSA-2026-Q3TCPK for full details.

Workarounds

Restrict network access to the Nowpayments IPN endpoint using an upstream proxy or web application firewall that allows only Nowpayments source IP ranges.
Temporarily disable the Nowpayments payment integration until the upgrade to 2.21.8 is deployed.
Enforce server-side validation that resolves the target organization from the authenticated session or verified transaction record, not the request body.

bash

# Example nginx location block restricting IPN endpoint access
location /api/billing/nowpayments {
    allow 198.51.100.0/24;   # Replace with Nowpayments provider ranges
    deny all;
    proxy_pass http://postiz_backend;
}