Find a vulnerability

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94455",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T18:13:58.426768Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T18:14:13.947Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "postiz-app",
          "product": "postiz-app",
          "repo": "https://github.com/gitroomhq/postiz-app",
          "vendor": "GitroomHQ",
          "versions": [
            {
              "lessThan": "2.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "You are affected if your deployment has billing enabled, that is if STRIPE_PUBLISHABLE_KEY or STRIPE_SECRET_KEY is set. This covers the hosted Postiz service and any self-hoster running Postiz commercially."
        },
        {
          "lang": "en",
          "value": "You are not meaningfully affected if you run a default self-hosted instance with no Stripe configuration. In that mode Postiz does not enforce subscription entitlements at all, so an organisation created through this endpoint holds no privileges your users do not already have."
        },
        {
          "lang": "en",
          "value": "Exposure is wider if self-registration is open, that is if DISABLE_REGISTRATION is unset or not set to \u0027true\u0027, because anyone on the internet can then obtain the account needed. With registration closed, the issue is reachable only by people who already hold an account on your instance."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Santosh Kumar Puppala"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Enno Gelhaus"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nevo David"
        }
      ],
      "datePublic": "2026-09-22T14:36:13.452Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes.\n\nThe endpoint\u0027s only check is that the request body carries a token bearing a valid signature from the instance secret. It does not check what that token was issued for. Login tokens are signed with the same secret and carry no purpose, audience or expiry claim, so an ordinary user\u0027s own session token satisfies the check.\n\nPresented with such a token, the endpoint creates a new organisation holding the highest subscription tier, flagged as lifetime and with a channel allowance far above any sold plan, creates an organisation-owner account alongside it, and returns the new organisation\u0027s API key in the response body. That key is immediately valid against the public API."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "1. Register an ordinary account on the target instance and capture that account\u0027s own login JWT."
        },
        {
          "lang": "en",
          "value": "2. POST /api/enterprise/create-user with body {\"params\": \"\u003cthat login JWT, verbatim\u003e\"}."
        },
        {
          "lang": "en",
          "value": "3. The response is 200 with {\"id\": \"\u003cnew organisation id\u003e\", \"apiKey\": \"\u003ckey\u003e\"}."
        },
        {
          "lang": "en",
          "value": "4. Confirm the new organisation carries subscriptionTier=ULTIMATE, isLifetime=true and totalChannels=1000000, and that it is distinct from the caller\u0027s own registration organisation."
        },
        {
          "lang": "en",
          "value": "5. Send the returned apiKey as the Authorization header against a public API endpoint and confirm 200, versus 401 for an invalid key."
        },
        {
          "lang": "en",
          "value": "Controls: an absent token, a malformed token, and a token with a valid-looking payload but a wrong signature all fail with no organisation created, confirming signature verification is the only gate."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Billing-integrity bypass. Any registered user can provision an organisation at the highest subscription tier, flagged as lifetime, with a channel allowance of 1,000,000 against the 100 provisioned for a genuine paying customer at that same tier."
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Recurring unmetered resource consumption. The per-organisation AI allowance (500 image generations, 60 video generations, 600 clipping minutes) refills on a rolling monthly window, and the lifetime flag exempts the organisation from subscription reconciliation, so each provisioned organisation is an indefinite draw on the operator\u0027s model and GPU budget rather than a one-off."
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Disclosure of a usable organisation API key in the response body, valid immediately against the public API without an interactive session."
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "No confidentiality impact on existing tenants. The provisioned organisation is empty; no other organisation\u0027s channels, posts, media or account data become reachable."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-1390",
              "description": "CWE-1390",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-345",
              "description": "CWE-345",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-770",
              "description": "CWE-770",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T16:17:00.413Z",
        "orgId": "4cdc9741-f887-419a-a2fd-acbbd2729276",
        "shortName": "postiz"
      },
      "references": [
        {
          "name": "Postiz",
          "tags": [
            "product"
          ],
          "url": "https://github.com/gitroomhq/postiz-app"
        },
        {
          "name": "v2.24.0",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.24.0"
        },
        {
          "name": "9259cf2",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/gitroomhq/postiz-app/commit/9259cf2429e8cc0c88414e88d5e6c783d7ffba63"
        },
        {
          "name": "GAdvisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://gadvisory.org/advisories/PSA-2026-P8W1J0"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-21T13:34:00.000Z",
          "value": "Postiz has received and acknowledged the report."
        },
        {
          "lang": "en",
          "time": "2026-09-21T20:15:00.000Z",
          "value": "Postiz has verified the report."
        },
        {
          "lang": "en",
          "time": "2026-09-22T04:32:00.000Z",
          "value": "Postiz has developed and verified the patch."
        },
        {
          "lang": "en",
          "time": "2026-09-22T14:17:00.000Z",
          "value": "Postiz has released the patch notes and published the advisory."
        }
      ],
      "title": "Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key",
      "workarounds": [
        {
          "lang": "en",
          "value": "Block POST /enterprise/create-user, and preferably all of /enterprise/*, at your reverse proxy, ingress or WAF. If you do not use Postiz\u0027s enterprise or reseller provisioning integration, nothing legitimate calls these routes, so blocking them has no user-visible effect."
        },
        {
          "lang": "en",
          "value": "Set DISABLE_REGISTRATION=true. The caller needs an ordinary account on your instance to obtain a usable token, so closing self-registration limits exposure to people who already have one. This reduces reach, it does not close the issue."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4cdc9741-f887-419a-a2fd-acbbd2729276",
    "assignerShortName": "postiz",
    "cveId": "CVE-2026-94455",
    "datePublished": "2026-09-22T16:17:00.413Z",
    "dateReserved": "2026-09-21T17:10:50.156Z",
    "dateUpdated": "2026-09-22T18:14:13.947Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94456",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T18:10:57.774548Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T18:11:17.502Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "postiz-app",
          "product": "postiz-app",
          "repo": "https://github.com/gitroomhq/postiz-app",
          "vendor": "GitroomHQ",
          "versions": [
            {
              "lessThan": "2.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "All deployments running the released code up to and including v2.23.0 are affected, self-hosted and hosted alike. The identifier helper is shared code reached by every credential-minting path, and there is no feature flag, environment variable or build option that selects a different random source."
        },
        {
          "lang": "en",
          "value": "The anonymous sampling surface, the OAuth dynamic client registration endpoint, is registered in both the default controller set and the MCP_ONLY controller set, so it is reachable in either deployment mode."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Santosh Kumar Puppala"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Enno Gelhaus"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nevo David"
        }
      ],
      "datePublic": "2026-09-22T14:17:43.125Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8\u2019s deterministic xorshift128+ PRNG state.\n\nAn unauthenticated OAuth dynamic client registration endpoint exposes freshly generated client credentials, giving attackers enough consecutive PRNG output to reconstruct that internal state. Once recovered, they can deterministically derive past and future values produced by the same generator, potentially compromising credentials belonging to other users and organizations."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "No public exploit code is known. The original submission was methodology-only and deliberately omitted a working implementation."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-59",
          "descriptions": [
            {
              "lang": "en",
              "value": "An unauthenticated attacker who predicts an OAuth access token minted for another organization is authenticated as that organization with SUPERADMIN rights over the public API, giving full read and write access to its scheduled posts, connected social accounts, media and team membership."
            }
          ]
        },
        {
          "capecId": "CAPEC-59",
          "descriptions": [
            {
              "lang": "en",
              "value": "The per-organization API key generated at registration is drawn from the same generator and is honoured by the same middleware with the same SUPERADMIN grant, so an attacker sampling the generator around a signup can predict the API key of a newly created organization."
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "OAuth client secrets, including those returned by anonymous dynamic client registration and by secret rotation, are predictable, allowing an attacker to impersonate a registered OAuth or MCP client to the token endpoint."
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Authorization codes issued at the consent step are predictable, exposing in-flight OAuth authorization flows to interception and redemption by a third party."
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "PKCE code verifiers generated for social account connections are predictable, removing the protection PKCE is present to provide for those provider flows."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-338",
              "description": "CWE-338",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-330",
              "description": "CWE-330",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-341",
              "description": "CWE-341",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T16:16:23.351Z",
        "orgId": "4cdc9741-f887-419a-a2fd-acbbd2729276",
        "shortName": "postiz"
      },
      "references": [
        {
          "name": "Postiz",
          "tags": [
            "product"
          ],
          "url": "https://github.com/gitroomhq/postiz-app"
        },
        {
          "name": "v2.24.0",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.24.0"
        },
        {
          "name": "9259cf24",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/gitroomhq/postiz-app/commit/9259cf2429e8cc0c88414e88d5e6c783d7ffba63"
        },
        {
          "name": "GAdvisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://gadvisory.org/advisories/PSA-2026-TD98KY"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Run a Postiz release in which security-sensitive identifiers are generated from a cryptographically secure random source rather than from Math.random(). No fixed release is available at the time of writing; this advisory will record the fixed version once one is published."
        },
        {
          "lang": "en",
          "value": "Once running a release with a corrected generator, treat every credential issued by an affected version as compromised and replace it. That covers organization API keys, OAuth application client secrets, and any outstanding OAuth access tokens and authorizations. Outstanding authorization codes are short-lived and expire on their own."
        },
        {
          "lang": "en",
          "value": "Operators who connected social accounts while running an affected version should review those connections, since the PKCE verifiers used to establish them were drawn from the same generator."
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-21T13:34:00.000Z",
          "value": "Postiz has received and acknowledged the report."
        },
        {
          "lang": "en",
          "time": "2026-09-21T20:15:00.000Z",
          "value": "Postiz has verified the report."
        },
        {
          "lang": "en",
          "time": "2026-09-22T04:32:00.000Z",
          "value": "Postiz has developed and verified the patch."
        },
        {
          "lang": "en",
          "time": "2026-09-22T14:17:00.000Z",
          "value": "Postiz has released the patch notes and published the advisory."
        }
      ],
      "title": "Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys",
      "workarounds": [
        {
          "lang": "en",
          "value": "Blocking or requiring authentication on the OAuth dynamic client registration endpoint at a reverse proxy, gateway or WAF removes the anonymous bulk-sampling surface, which is the part of this issue reachable without an account. It does not make the generated values unpredictable, and it does not close the surfaces available to an authenticated user, so it narrows exposure rather than resolving it. Deployments that do not use OAuth or MCP client integrations can apply this with no loss of function."
        },
        {
          "lang": "en",
          "value": "Rotating organization API keys or OAuth client secrets while still running an affected version does not help, and should not be relied on as a mitigation. The replacement value is produced by the same generator and is predictable on the same terms as the value it replaces. Rotation is only meaningful once the generator itself no longer draws from Math.random()."
        },
        {
          "lang": "en",
          "value": "Where the deployment allows it, restricting the public API to known client networks limits who can present a predicted credential. This is a containment measure for the consequence rather than a fix for the predictability."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4cdc9741-f887-419a-a2fd-acbbd2729276",
    "assignerShortName": "postiz",
    "cveId": "CVE-2026-94456",
    "datePublished": "2026-09-22T16:11:33.674Z",
    "dateReserved": "2026-09-21T17:11:13.201Z",
    "dateUpdated": "2026-09-22T18:11:17.502Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19264",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-07T17:54:32.053150Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-07T17:54:47.917Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "postiz-app",
          "product": "postiz-app",
          "repo": "https://github.com/gitroomhq/postiz-app",
          "vendor": "gitroomhq",
          "versions": [
            {
              "lessThan": "2.22.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Exploitation requires the environment variable STORAGE_PROVIDER to be set to \u0027local\u0027, which is the default value shipped in .env.example. On any other storage backend the /uploads route is rewritten to /404 and the vulnerable handler is unreachable."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "KRITHIK BABU P"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Enno Gelhaus"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nevo David"
        }
      ],
      "dateAssigned": "2026-08-07T14:13:00.000Z",
      "datePublic": "2026-08-07T14:14:58.259Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw dot-segments are collapsed before routing, but URL-encoded separators survive route matching and are decoded only once they reach the handler, restoring the traversal at the filesystem call. An unauthenticated remote attacker can therefore read any file readable by the application process, including the process environment, which exposes the JWT signing secret, the database connection string, and connected provider and billing secrets. Because session tokens are signed with that secret and carry no expiry, this allows forging a non-expiring session as any user, including an administrator, without a password."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-24T11:15:08.324Z",
        "orgId": "4cdc9741-f887-419a-a2fd-acbbd2729276",
        "shortName": "postiz"
      },
      "references": [
        {
          "name": "7936062",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/gitroomhq/postiz-app/commit/7936062"
        },
        {
          "name": "v2.22.1",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.22.1"
        },
        {
          "name": "GAdvisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://gadvisory.org/advisories/PSA-2026-TH12B7"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-20T05:55:00.000Z",
          "value": "Postiz has received the advisory."
        },
        {
          "lang": "en",
          "time": "2026-07-20T07:44:00.000Z",
          "value": "Postiz has acknowledged and verified the advisory."
        },
        {
          "lang": "en",
          "time": "2026-07-20T12:18:00.000Z",
          "value": "Postiz has published a fix for this advisory, and verified that it works."
        },
        {
          "lang": "en",
          "time": "2026-08-07T14:13:00.000Z",
          "value": "Postiz has issued CVE-2026-19264 for this advisory."
        }
      ],
      "title": "Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4cdc9741-f887-419a-a2fd-acbbd2729276",
    "assignerShortName": "postiz",
    "cveId": "CVE-2026-19264",
    "datePublished": "2026-08-07T14:15:15.123Z",
    "dateReserved": "2026-08-07T14:09:09.890Z",
    "dateUpdated": "2026-08-24T11:15:08.324Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19127",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-07T14:02:58.803040Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-07T14:03:32.512Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "postiz-app",
          "product": "postiz-app",
          "vendor": "GitroomHQ",
          "versions": [
            {
              "lessThan": "2.21.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Stripe has to be configured for this to apply."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Enno Gelhaus"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Enno Gelhaus"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nevo David"
        }
      ],
      "dateAssigned": "2026-08-06T16:04:00.000Z",
      "datePublic": "2026-06-22T13:46:51.287Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows. By exploiting insufficient cryptographic validation or lack of server-side state verification on promotional/lifetime-deal (LTD) redemption codes, an unauthenticated attacker can forge valid redemption tokens or replay existing single-use codes to activate permanent, tier-highest paid subscriptions without a financial transaction."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-07T10:47:07.050Z",
        "orgId": "4cdc9741-f887-419a-a2fd-acbbd2729276",
        "shortName": "postiz"
      },
      "references": [
        {
          "name": "387d85d",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/gitroomhq/postiz-app/commit/387d85dabe0223cd930714c19072a0aee58541ca"
        },
        {
          "name": "v2.21.10",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.10"
        },
        {
          "name": "GAdvisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://gadvisory.org/advisories/PSA-2026-NWZN9J"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "No solution other than upgrading to v2.21.10 is currently known."
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-21T18:00:00.000Z",
          "value": "Postiz has discovered the vulnerability."
        },
        {
          "lang": "en",
          "time": "2026-06-22T13:20:00.000Z",
          "value": "Postiz has developed and verified the fix."
        },
        {
          "lang": "en",
          "time": "2026-06-22T13:44:00.000Z",
          "value": "Postiz has created the release and published the advisory."
        },
        {
          "lang": "en",
          "time": "2026-08-06T16:04:00.000Z",
          "value": "Postiz has assigned CVE-2026-19127 for this advisory."
        }
      ],
      "title": "Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions",
      "workarounds": [
        {
          "lang": "en",
          "value": "No workaround other than upgrading to v2.21.10 is currently known."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4cdc9741-f887-419a-a2fd-acbbd2729276",
    "assignerShortName": "postiz",
    "cveId": "CVE-2026-19127",
    "datePublished": "2026-08-06T17:02:44.054Z",
    "dateReserved": "2026-08-06T15:49:22.192Z",
    "dateUpdated": "2026-08-07T14:03:32.512Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}