DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-59817: CVE-2026-59817: Premium Membership Provisioning Bypass via Parameter Tampering in Ghost CMS

#security #cve #cybersecurity

CVE-2026-59817: Premium Membership Provisioning Bypass via Parameter Tampering in Ghost CMS

Vulnerability ID: CVE-2026-59817
CVSS Score: 5.3
Published: 2026-08-04

An unauthenticated remote business logic vulnerability in Ghost CMS versions 6.27.0 through 6.43.1 allows attackers to bypass paid subscription gates. By injecting reserved metadata fields into public donation Stripe Checkout Sessions, attackers can obtain premium-tier memberships for arbitrary nominal amounts.

TL;DR

Unauthenticated remote attackers can obtain premium paid subscriptions for nominal costs by exploiting weak metadata sanitization and logical errors in Ghost's Stripe checkout integration.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-915
  • Attack Vector: Network (AV:N)
  • CVSS Score: 5.3 (Medium)
  • EPSS Score: 0.00257 (17.25 percentile)
  • Impact: Integrity Level Low (I:L), No Confidentiality/Availability Impact
  • Exploit Status: Proof-of-concept validated
  • KEV Status: Not Listed in CISA KEV

Affected Systems

  • Ghost CMS
  • Ghost: >= 6.27.0, < 6.44.0 (Fixed in: 6.44.0)

Code Analysis

Commit: ee7b991

Enforce donation setting validation inside RouterController

Commit: cab716c

Implement metadata sanitization blocklist inside Stripe session helper

Mitigation Strategies

  • Upgrade Ghost CMS to version 6.44.0 or later to apply formal metadata sanitization and setting checks.
  • Disable the 'Tips & donations' feature globally within the administrative settings to remove the vulnerable endpoint from production routing.
  • Deploy custom Web Application Firewall (WAF) inspect rules on reverse proxies to drop HTTP POST requests to the Stripe checkout creation endpoint containing reserved parameter injections.

Remediation Steps:

  1. Access the server hosting the Ghost CMS installation via SSH.
  2. Execute the update command 'ghost update' to pull and apply the latest release.
  3. Verify that the active production version is 6.44.0 or newer by executing 'ghost version'.
  4. Restart the instance using 'ghost restart' to ensure all memory contexts are cleared.
  5. Inspect application logs for Stripe webhook processing warnings to identify any residual malicious activity.

References

Read the full report for CVE-2026-59817 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)