CVE-2026-19127

Published: Ago 07, 2026 Last Modified: Ago 07, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,5
Source: 4cdc9741-f887-419a-a2fd-acbbd2729276
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: high
Availability: none

Description

AI Translation Available

An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows. By exploiting insufficient cryptographic validation or lack of server-side state verification on promotional/lifetime-deal (LTD) redemption codes, an unauthenticated attacker can forge valid redemption tokens or replay existing single-use codes to activate permanent, tier-highest paid subscriptions without a financial transaction.

345

Insufficient Verification of Data Authenticity

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Other
Potential Impacts:
Varies By Context Unexpected State
Applicable Platforms
Technologies: ICS/OT
View CWE Details
https://gadvisory.org/advisories/PSA-2026-NWZN9J
https://gadvisory.org/advisories/PSA-2026-NWZN9J
https://github.com/gitroomhq/postiz-app/commit/387d85dabe02…
https://github.com/gitroomhq/postiz-app/commit/387d85dabe0223cd930714c19072a0ae…
https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.…
https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.10