CVE-2026-48783

{
  "id": "CVE-2026-48783",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-17T13:20:43.353",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated endpoint that accepted a signed token and applied subscription-enforcement side effects to the organization referenced in that token's claims, without verifying the token's intended purpose. The endpoint, /public/modify-subscription, could not change the persisted subscription tier, but it did execute enforcement-related side effects on the caller's own organization, including adjusting team-member enablement state, disabling integrations exceeding the asserted plan's limits, and resetting the scheduled-post cron when the asserted plan was the free tier. Impact is limited to the attacker's own organization and cannot be redirected at other tenants through this endpoint. This issue has been fixed in version 2.21.8."
    },
    {
      "lang": "es",
      "value": "Postiz es una herramienta de programación de redes sociales con IA. Las versiones anteriores a la 2.21.8 contenían un endpoint no autenticado que aceptaba un token firmado y aplicaba efectos secundarios de aplicación de suscripción a la organización referenciada en las declaraciones de ese token, sin verificar el propósito previsto del token. El endpoint, /public/modify-subscription, no podía cambiar el nivel de suscripción persistido, pero sí ejecutaba efectos secundarios relacionados con la aplicación en la propia organización del llamador, incluyendo el ajuste del estado de habilitación de los miembros del equipo, la deshabilitación de integraciones que excedían los límites del plan declarado, y el restablecimiento del cron de publicaciones programadas cuando el plan declarado era el nivel gratuito. El impacto se limita a la propia organización del atacante y no puede ser redirigido a otros inquilinos a través de este endpoint. Este problema ha sido solucionado en la versión 2.21.8."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "gitroomhq",
          "product": "postiz-app",
          "versions": [
            {
              "version": "< 2.21.8",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-17T12:43:27.137971Z",
          "id": "CVE-2026-48783",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-345"
        },
        {
          "lang": "en",
          "value": "CWE-639"
        },
        {
          "lang": "en",
          "value": "CWE-749"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://gadvisory.org/advisories/PSA-2026-WWFR8X",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/gitroomhq/postiz-app/commit/23696d2973510ae1f3f48bfa41a6bfbbf9827b05",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.8",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-v4wr-4j8g-4hfj",
      "source": "[email protected]"
    }
  ]
}