Skip to content
CVE PROGRAM SOURCE RECORD4.8 Medium

CVE-2026-70589

Ghost: Archived Offers can be Redeemed

Description

Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offers that were no longer active. This issue is fixed in version 6.54.1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TryGhost Ghost

  • >= 4.22.0, < 6.54.1affected

References