VulnerabilityDeferred

CVE-2026-70589

From 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offers that were no longer active.

MEDIUM 4.8EPSS 0.17%

Does this matter?

Lower severity and a low EPSS score (0.17%). Track it; it rarely justifies an emergency change on its own.

Description

Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offers that were no longer active. This issue is fixed in version 6.54.1.

CVSS 3.1: 4.8 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS: 0.17% probability · 7th percentile
CISA KEV: Not listed
Weakness: CWE-20
Source: security-advisories@github.com

References

https://github.com/TryGhost/Ghost/commit/d91c0fc52dfc987d71a9803dbcbe6447d21b92fb
https://github.com/TryGhost/Ghost/security/advisories/GHSA-4wx2-7gvj-qfq3

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.