Executive brief
Ghost, a popular open-source publishing platform, contained a flaw in its subscription management system. This vulnerability allowed users to redeem promotional offers that had been archived or deactivated by the site administrator. This could lead to unauthorized discounts or subscription access, potentially impacting revenue and business operations.
Technical details
A vulnerability classified as Improper Input Validation (CWE-20) existed in the Ghost membership API. The `router-controller.js` component failed to verify the status of a subscription offer during the redemption process. An attacker could exploit this by submitting a request to redeem an offer ID that was previously deactivated or archived. The fix, introduced in version 6.54.1, adds a check to ensure the offer status is explicitly 'active' before processing the redemption. The attack complexity is considered high as it requires knowledge of specific archived offer IDs.
Affected products
- Ghost Foundation Ghost >= 4.22.0, < 6.54.1
Timeline
- 2026-07-30: disclosed: Initial disclosure by Pedro Pinho
- 2026-07-30: patched: Fix committed to Ghost repository
- 2026-08-04: advisory: GitHub Advisory published