What is the CVSS score of CVE-2026-70589?

CVE-2026-70589 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-70589?

Yes, a public proof-of-concept exploit is available for CVE-2026-70589. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-70589?

Yes, a patch is available for CVE-2026-70589. Update the affected software to the latest version immediately.

Ghost CMS CVE-2026-70589

EUVD-2026-52929 MEDIUM

Improper Input Validation (CWE-20)

2026-08-04 https://github.com/TryGhost/Ghost

GHSA-4wx2-7gvj-qfq3

Docker Information Disclosure

4.8

CVSS 3.1 · Vendor: https://github.com/TryGhost/Ghost

Severity by source

Vendor (https://github.com/TryGhost/Ghost) PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

4.8 MEDIUM

Network-accessible public checkout endpoint, but AC:H because attacker must possess a non-enumerable archived offer UUID; no auth required per PR:N; limited confidentiality and integrity impact only.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/TryGhost/Ghost).

CVSS VectorVendor: https://github.com/TryGhost/Ghost

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Aug 04, 2026 - 21:36 vuln.today

Analysis Generated

Aug 04, 2026 - 21:36 vuln.today

DescriptionCVE.org

Impact

A missing validation check allowed users to redeem subscription offers that were no longer active.

Vulnerable versions

This vulnerability is present in Ghost from v4.22.0 up to v6.54.0.

Patches

v6.54.1 contains a fix for this issue.

How to update

For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.

If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.

References

Ghost thanks Pedro Pinho for disclosing this vulnerability responsibly.

For more information

If you have any questions or comments about this advisory, email us at [security@ghost.org](mailto:security@ghost.org).

AnalysisAI

Ghost CMS subscription checkout accepts redemption of archived offers due to missing offer-status validation in the member router controller, affecting all self-hosted Ghost instances from v4.22.0 through v6.54.0. Unauthenticated users who possess or can discover an archived offer ID can submit a valid checkout request and obtain unauthorized subscription discounts or access at a revoked price point. No public exploit code has been identified and this CVE is absent from CISA KEV, but the direct financial impact on subscription-based Ghost sites makes it a meaningful business-logic risk for affected operators.

Technical ContextAI

Ghost (npm package: pkg:npm/ghost) is a Node.js open-source publishing and membership platform with Stripe-integrated subscription and offer management. The vulnerability resides in the _getSubscriptionCheckoutData method within ghost/core/core/server/services/members/members-api/controllers/router-controller.js. This method retrieves an offer object by its ID during checkout but, prior to v6.54.1, never validated the retrieved offer's status field against the expected value of 'active'. Offers in 'archived' status were indistinguishable from active ones at the checkout layer, allowing the flow to proceed to Stripe payment processing with a revoked offer applied. CWE-20 (Improper Input Validation) correctly identifies the root cause: a business-state property of a server-side resource was not checked before acting on the user-supplied reference. The fix confirmed in commit d91c0fc52dfc987d71a9803dbcbe6447d21b92fb adds an explicit guard: if (offer.status && offer.status !== 'active') throw new BadRequestError(...), preventing archived offer IDs from reaching downstream subscription logic.

RemediationAI

Upgrade Ghost to v6.54.1 or later, which contains the server-side status validation fix confirmed in commit d91c0fc52dfc987d71a9803dbcbe6447d21b92fb. For Docker-based self-hosters, pull the updated official Ghost image from hub.docker.com/_/ghost and redeploy per Ghost's Docker update documentation at https://docs.ghost.org/install/docker#updating-ghost. For Ghost-CLI installations, follow the upgrade procedure at https://docs.ghost.org/update. If immediate upgrading is not possible, a targeted compensating control would be to audit current archived offers in the Ghost admin panel and, where feasible, delete rather than merely archive any sensitive promotional offers to eliminate the redeemable IDs entirely - deletion removes the database record the checkout controller would resolve, whereas archiving only sets the status flag that was not previously checked. Note that deleting offers may affect historical subscription reporting. There is no network-layer mitigation that would address this without also disrupting the legitimate checkout flow.