Postiz Security Advisories
All advisories
PSA-2026-NWZN9JCVE-2026-19127GCVE-125-2026-NWZN9JJune 22, 2026Assigned August 6, 2026
6.5 Medium

Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions

Affected (1)

  • GitroomHQpostiz-app
    • ≥ 0Fixed in 2.21.10Affected

    All other versions: Unaffected

Mitigations

Workarounds

  • No workaround other than upgrading to v2.21.10 is currently known.

Solutions

  • No solution other than upgrading to v2.21.10 is currently known.

Configurations

  • Stripe has to be configured for this to apply.

Overview

An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows. By exploiting insufficient cryptographic validation or lack of server-side state verification on promotional/lifetime-deal (LTD) redemption codes, an unauthenticated attacker can forge valid redemption tokens or replay existing single-use codes to activate permanent, tier-highest paid subscriptions without a financial transaction.

Severity

CVSS v3
6.5 Medium
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Weaknesses (1)

References (2)

Credits (3)

  • Enno Gelhaus
    Reporter · @egelhaus
  • Enno Gelhaus
    Coordinator · @egelhaus
  • Nevo David
    Remediation developer · @nevo-david

Context

Timeline

  1. 06/21/2026 18:00

    Postiz has discovered the vulnerability.

  2. 06/22/2026 13:20

    Postiz has developed and verified the fix.

  3. 06/22/2026 13:44

    Postiz has created the release and published the advisory.

  4. 08/06/2026 16:04

    Postiz has assigned CVE-2026-19127 for this advisory.