What is the CVSS score of EUVD-2026-42658?

EUVD-2026-42658 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for EUVD-2026-42658?

Yes, a patch is available for EUVD-2026-42658. Update the affected software to the latest version immediately.

Ghost CMS EUVD-2026-42658

| CVE-2026-59817 MEDIUM

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-07-09 security-advisories@github.com

GHSA-xm43-3m56-w3wf

Information Disclosure Node.js

5.3

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Public-facing unauthenticated checkout endpoint, low complexity to manipulate; integrity impact limited to unauthorized membership grant with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 09, 2026 - 19:01 EUVD

Analysis Generated

Jul 09, 2026 - 18:49 vuln.today

DescriptionCVE.org

Ghost is a Node.js content management system. From 6.27.0 before 6.44.0, Ghost's public donation checkout flow allowed an unauthenticated attacker to control donation checkout metadata and obtain full paid gift memberships for a minimal payment without exposing customer or member data or stealing money from a site or its members. This issue is fixed in version 6.44.0.

AnalysisAI

Ghost CMS versions 6.27.0 through 6.43.x permit unauthenticated attackers to manipulate donation checkout metadata, enabling acquisition of full paid gift memberships for a minimal payment. The flaw, classified as CWE-472 (External Control of Assumed-Immutable Web Parameter), stems from the server trusting client-controlled parameters in the public-facing checkout flow that should be server-authoritative. No active exploitation is confirmed (not in CISA KEV) and no public exploit has been identified; the vendor released a fix in version 6.44.0.

Technical ContextAI

Ghost is a Node.js-based open-source content management system with built-in membership and monetization features. The vulnerability resides in the public donation checkout flow, which interfaces with a payment processor (likely Stripe) to grant gift memberships. CWE-472 (External Control of Assumed-Immutable Web Parameter) describes a class of flaw where server-side logic trusts client-submitted values - such as POST body fields or API request parameters - that should be derived or validated server-side. Here, donation checkout metadata controlling membership tier or gift membership type is not adequately validated, allowing the server to grant a higher-value membership than the payment actually covers. No CPE strings were included in the input; affected product is the Ghost open-source platform, Node.js-based, versions 6.27.0 to before 6.44.0.

RemediationAI

Upgrade to Ghost version 6.44.0, which contains the complete fix per the vendor security advisory GHSA-xm43-3m56-w3wf. The upstream changes are captured in commits cab716cd015ac04b7ee50c7a405478d97bc7b1e0 and ee7b991b466a7849c70f9d1caed8e491ee4113c6, and pull requests #28351 and #28352 at https://github.com/TryGhost/Ghost/pull/28351 and https://github.com/TryGhost/Ghost/pull/28352. If an immediate upgrade is not feasible, consider temporarily disabling the public donation checkout and gift membership feature through Ghost's admin configuration - this eliminates the attack surface entirely but interrupts legitimate donation revenue flows. No other vendor-documented workaround is available from the provided sources.