EUVD-2026-54191Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-accessible endpoint requires org-scoped account (PR:L); impact is purely subscription-integrity fraud with no confidentiality or availability effects.
Primary rating from Vendor (4cdc9741-f887-419a-a2fd-acbbd2729276).
CVSS VectorVendor: 4cdc9741-f887-419a-a2fd-acbbd2729276
Lifecycle Timeline
3DescriptionCVE.org
An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows. By exploiting insufficient cryptographic validation or lack of server-side state verification on promotional/lifetime-deal (LTD) redemption codes, an unauthenticated attacker can forge valid redemption tokens or replay existing single-use codes to activate permanent, tier-highest paid subscriptions without a financial transaction.
AnalysisAI
The billing controller in Postiz (postiz-app) before v2.21.10 allows exploitation of an unauthenticated or lightly authenticated API endpoint to activate permanent top-tier paid subscriptions without financial transaction, by forging or replaying lifetime-deal redemption codes against a backend that performs no cryptographic validation or single-use enforcement. The vulnerable /lifetime POST endpoint passed user-supplied codes directly into the Stripe-integrated lifetimeDeal service with no server-side state verification, a textbook CWE-345 (Insufficient Verification of Data Authenticity) failure. No public exploit has been identified and this CVE is not listed in CISA KEV; the fix in v2.21.10 was complete endpoint removal, confirmed via the upstream GitHub commit.
Technical ContextAI
Postiz is an open-source social media scheduling and management platform built on a NestJS TypeScript backend. The root cause is CWE-345 (Insufficient Verification of Data Authenticity) within apps/backend/src/api/routes/billing.controller.ts. The removed endpoint - @Post('/lifetime') - accepted a body.code string and passed it along with the caller's org ID directly to this._stripeService.lifetimeDeal(org.id, body.code) with no validation of code authenticity, cryptographic signature, expiry, or prior-use state. This allowed an attacker to present a crafted, predicted, or replayed promotional redemption code and have the backend honor it unconditionally. The affected CPE-equivalent scope is all postiz-app releases from version 0 up to (not including) 2.21.10. The fix confirmed by the commit at https://github.com/gitroomhq/postiz-app/commit/387d85dabe0223cd930714c19072a0aee58541ca was wholesale removal of the endpoint rather than adding validation, indicating the design was fundamentally unsalvageable.
RemediationAI
Upgrade postiz-app to version 2.21.10 or later; this is a vendor-released patch confirmed at https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.10 and https://gadvisory.org/advisories/PSA-2026-NWZN9J. The fix removes the /billing/lifetime POST endpoint entirely - there is no partial mitigation option within the codebase itself. For operators unable to upgrade immediately, block HTTP POST requests to the /api/billing/lifetime path at the reverse proxy or WAF layer; note that this trade-off disables all legitimate lifetime deal redemptions for users, so it is only suitable as a temporary hold until the upgrade is applied. Following remediation, operators should audit existing accounts' subscription tiers and cross-reference against Stripe payment records to identify any subscriptions fraudulently activated through the now-removed endpoint prior to the patch.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today