Postiz CVE-2026-48783

Exploitation requires two specific conditions: first, a validly signed token accepted by the /public/modify-subscription endpoint, originating from the NowPayments crypto payment integration signing key - either intercepted from a prior payment callback or derived from knowledge of the key; second, the target Postiz instance must have had the NowPayments crypto payment feature configured and active (non-default for most deployments without a configured NowPayments API key). Impact is categorically limited to the attacker's own organization - the endpoint does not accept organization IDs from the caller that differ from those encoded in the token's claims, preventing cross-tenant attacks. The AC:H CVSS metric quantifies the key barrier: obtaining or forging a valid signed token is the primary obstacle to exploitation. No Postiz account authentication is required by the endpoint itself.

The CVSS 3.1 score of 4.8 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L is consistent with the described constraints. The AC:H metric is the critical signal: exploitation requires obtaining or crafting a token that the endpoint accepts, implying access to the NowPayments signing key or a replayable prior payment callback token - a non-trivial barrier. The PR:N metric reflects that no Postiz authentication is required by the endpoint itself, but the token requirement acts as an indirect credential. No EPSS score was provided in the source data, and neither a CISA KEV listing nor public POC code has been identified, further reducing urgency. The strongest real-world mitigant is the strict self-tenancy limitation: the endpoint cannot be used to sabotage other organizations' integrations or schedules. The integrity and availability impacts (I:L, A:L) are real but operationally bounded - disabling integrations and resetting crons within one's own organization is disruptive but not catastrophic. This is a genuine Medium and not a high-CVSS-but-low-risk mismatch; the score accurately reflects the constrained impact and elevated attack complexity.

An attacker who has previously completed or intercepted a NowPayments crypto payment flow for their own Postiz organization captures a validly signed callback token from that flow. They replay this token in a POST request to /public/modify-subscription with claims asserting a free-tier plan, causing their organization's social media integrations above the free-plan limit to be disabled and the scheduled-post cron to be reset - effectively disrupting their own Postiz service. No public exploit code has been identified at time of analysis, and crafting a fresh token without access to the signing key is not feasible.