Executive brief
Ghost is a publishing platform that allows websites to manage paid memberships. An authentication bypass in member-related endpoints enables attackers to perform member-only actions (such as updating account settings or creating content) and access private member information without valid credentials. Affected sites with membership features enabled are at risk of unauthorized member impersonation and data exposure.
Technical details
The vulnerability stems from improper authentication validation on endpoints used for member actions. Affected versions (Ghost v4.46.0–v5.89.5) fail to correctly authenticate requests to member-only endpoints, allowing unauthenticated attackers to read member data and perform actions restricted to authenticated members. The flaw affects both the core Ghost package and the @tryghost/portal component. No special privileges or user interaction are required; exploitation requires only network access to the vulnerable endpoints. Version 5.89.5 contains the fix. As a workaround, administrators can disable site membership in Ghost settings.
Affected products
- Ghost Ghost 4.46.0–5.89.5
- Ghost @tryghost/portal 1.22.2–2.39.0
Timeline
- 2024-08-20: disclosed
- 2024-08-20: patched: Fixed in Ghost v5.89.5