Remote Code Execution Vulnerability in Billing and License Activation for Postiz by Gitroom
CVE-2026-19127

6.5MEDIUM

Key Information:

Vendor

Gitroomhq

Status
Postiz-app
Vendor
CVE Published:
6 August 2026

What is CVE-2026-19127?

A flaw in the billing and license activation subsystem of Postiz allows remote attackers to circumvent payment authorization processes. Due to inadequate cryptographic validation and insufficient server-side state verification for promotional and lifetime-deal redemption codes, unauthenticated users can forge valid redemption tokens or reuse existing single-use codes. This exploitation enables them to activate top-tier paid subscriptions without any financial transactions, posing a significant security risk for users and the integrity of the billing system.

Affected Version(s)

postiz-app 0 < 2.21.10

References

https://github.com/gitroomhq/postiz-app/commit/387d85dabe...
patch
https://github.com/gitroomhq/postiz-app/releases/tag/v2.2...
release-notes
https://gadvisory.org/advisories/PSA-2026-NWZN9J
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Enno Gelhaus
Enno Gelhaus
Nevo David
.