{"uuid": "d343a743-80bb-4a0c-9089-d34f44106e3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59817", "type": "seen", "source": "https://gist.github.com/alon710/206e14659b338e0afd8d846fac0809f6", "content": "# CVE-2026-59817: CVE-2026-59817: Premium Membership Provisioning Bypass via Parameter Tampering in Ghost CMS\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59817\n\n## Summary\nAn unauthenticated remote business logic vulnerability in Ghost CMS versions 6.27.0 through 6.43.1 allows attackers to bypass paid subscription gates. By injecting reserved metadata fields into public donation Stripe Checkout Sessions, attackers can obtain premium-tier memberships for arbitrary nominal amounts.\n\n## TL;DR\nUnauthenticated remote attackers can obtain premium paid subscriptions for nominal costs by exploiting weak metadata sanitization and logical errors in Ghost's Stripe checkout integration.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-915\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.3 (Medium)\n- **EPSS Score**: 0.00257 (17.25 percentile)\n- **Impact**: Integrity Level Low (I:L), No Confidentiality/Availability Impact\n- **Exploit Status**: Proof-of-concept validated\n- **KEV Status**: Not Listed in CISA KEV\n\n## Affected Systems\n\n- Ghost CMS\n- **Ghost**: >= 6.27.0, < 6.44.0 (Fixed in: `6.44.0`)\n\n## Mitigation\n\n- Upgrade Ghost CMS to version 6.44.0 or later to apply formal metadata sanitization and setting checks.\n- Disable the 'Tips & donations' feature globally within the administrative settings to remove the vulnerable endpoint from production routing.\n- Deploy custom Web Application Firewall (WAF) inspect rules on reverse proxies to drop HTTP POST requests to the Stripe checkout creation endpoint containing reserved parameter injections.\n\n**Remediation Steps:**\n1. Access the server hosting the Ghost CMS installation via SSH.\n2. Execute the update command 'ghost update' to pull and apply the latest release.\n3. Verify that the active production version is 6.44.0 or newer by executing 'ghost version'.\n4. Restart the instance using 'ghost restart' to ensure all memory contexts are cleared.\n5. Inspect application logs for Stripe webhook processing warnings to identify any residual malicious activity.\n\n## References\n\n- [GitHub Security Advisory GHSA-xm43-3m56-w3wf](https://github.com/TryGhost/Ghost/security/advisories/GHSA-xm43-3m56-w3wf)\n- [GitHub Pull Request #28351](https://github.com/TryGhost/Ghost/pull/28351)\n- [GitHub Pull Request #28352](https://github.com/TryGhost/Ghost/pull/28352)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59817) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T00:00:39.829281Z"}