BIT-ghost-2026-70589

vendorUSosv

Ghost: Archived Offers can be Redeemed

view advisory published 2026-08-17Licence: per source

Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offers that were no longer active. This issue is fixed in version 6.54.1.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-70589US	—	0.27% (19th)	—	2026-08-04
Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offers that were no longer active. This issu…

references

External citations — patches, advisories, analysis.

https://github.com/TryGhost/Ghost/commit/d91c0fc52dfc987d71a9803dbcbe6447d21b92fbWEB
https://github.com/TryGhost/Ghost/security/advisories/GHSA-4wx2-7gvj-qfq3WEB
https://nvd.nist.gov/vuln/detail/CVE-2026-70589WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan