{"vulnerability": "ghsa-4wx2-7gvj-qfq3", "sightings": [{"uuid": "7bf71863-c369-4e7d-9ca0-30254ec0f99e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-4wx2-7gvj-qfq3", "type": "seen", "source": "https://gist.github.com/alon710/8a67496a2aeb5dc5719baf5a0f706ea5", "content": "# CVE-2026-70589: CVE-2026-70589: Improper Status Validation in Ghost CMS Offer Redemption\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70589\n\n## Summary\nA business logic vulnerability in Ghost CMS allows unauthenticated remote users to redeem deactivated or archived promotional subscription offers by programmatically passing old offer identifiers during the checkout session initialization.\n\n## TL;DR\nUnauthenticated users can bypass UI-level status checks to redeem archived promotional discount offers, resulting in unauthorized pricing discounts during membership checkout.\n\n## Technical Details\n\n- **CWE ID**: CWE-20\n- **Attack Vector**: Network\n- **CVSS Base Score**: 4.8\n- **Impact**: Unauthorized Pricing Discounts / Membership Manipulation\n- **Exploit Status**: No Public Exploit\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ghost CMS Core Subscription Subsystem\n- **Ghost**: >= 4.22.0, < 6.54.1 (Fixed in: `6.54.1`)\n\n## Mitigation\n\n- Upgrade to Ghost CMS version 6.54.1 or higher.\n- Manually archive or delete corresponding coupon codes in the Stripe Dashboard.\n- Monitor API logs for recurring checkout failures associated with archived offer IDs.\n\n**Remediation Steps:**\n1. Identify the current running version of Ghost CMS.\n2. Execute 'ghost update' to pull the latest security release (6.54.1 or newer).\n3. Log into the Stripe dashboard connected to the Ghost instance.\n4. Verify that old promotional coupon codes are fully deactivated directly in Stripe.\n\n## References\n\n- [Official GitHub Security Advisory](https://github.com/TryGhost/Ghost/security/advisories/GHSA-4wx2-7gvj-qfq3)\n- [Official Technical Fix Commit](https://github.com/TryGhost/Ghost/commit/d91c0fc52dfc987d71a9803dbcbe6447d21b92fb)\n- [CVE Registry Record](https://www.cve.org/CVERecord?id=CVE-2026-70589)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70589) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T09:31:26.149313Z"}]}