CVE-2026-70589CWE-20

CVE-2026-70589

Medium · published August 5, 2026

CVSS v3.1
4.8
EPSS
0%
Percentile
18.1
In the wild
Unconfirmed
What it is

Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offers that were no longer active. This issue is fixed in version 6.54.1.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00270 · 18.1th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-08-05T02:17Z
References (2)
https://github.com/TryGhost/Ghost/commit/d91c0fc52dfc987d71a9803dbcbe6447d21b92fb · [email protected]https://github.com/TryGhost/Ghost/security/advisories/GHSA-4wx2-7gvj-qfq3 · [email protected]
EPSS history
Timeline
  • 04 AUG 21:11Z
    Ghost: Archived Offers can be Redeemed
    cvelistv5