Unauthenticated Endpoint Vulnerability in Postiz AI Social Media Scheduling Tool

CVE-2026-48783

What is CVE-2026-48783?

Postiz, an AI-driven social media scheduling tool, has a vulnerability in versions before 2.21.8 that features an unauthenticated endpoint. This endpoint, located at /public/modify-subscription, accepts signed tokens without validating their intended use. Although this issue does not permit changing subscription tiers, it allows attackers to trigger specific enforcement actions against their own organization, such as modifying team member access, disabling integrations that exceed their subscription plan, and resetting scheduled posts when on a free tier. This vulnerability's impact is confined to the attacker's organization, preventing exploitation against other users or tenants.

References