The vulnerability arises from insufficient cryptographic validation or lack of server-side state verification in the promotional and lifetime-deal (LTD) redemption code handling of the postiz-app billing and license activation subsystem. An attacker can remotely bypass payment authorization workflows by forging valid redemption tokens or replaying single-use codes, thereby activating permanent, highest-tier paid subscriptions without completing a financial transaction. The CVSS 3.1 base score is 6.5 (medium), with network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. There is no vendor advisory or patch information available at this time.

Successful exploitation allows an unauthenticated remote attacker to bypass payment authorization and activate permanent, highest-tier paid subscriptions without paying. This impacts the integrity of the billing system by enabling unauthorized subscription activations. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should monitor for updates from GitroomHQ and consider restricting or closely auditing promotional code redemption workflows to detect suspicious activity.