CVE-2026-70589: Improper Status Validation in Ghost CMS Offer Redemption
Vulnerability ID: CVE-2026-70589
CVSS Score: 4.8
Published: 2026-08-04
A business logic vulnerability in Ghost CMS allows unauthenticated remote users to redeem deactivated or archived promotional subscription offers by programmatically passing old offer identifiers during the checkout session initialization.
TL;DR
Unauthenticated users can bypass UI-level status checks to redeem archived promotional discount offers, resulting in unauthorized pricing discounts during membership checkout.
Technical Details
- CWE ID: CWE-20
- Attack Vector: Network
- CVSS Base Score: 4.8
- Impact: Unauthorized Pricing Discounts / Membership Manipulation
- Exploit Status: No Public Exploit
- KEV Status: Not Listed
Affected Systems
- Ghost CMS Core Subscription Subsystem
-
Ghost: >= 4.22.0, < 6.54.1 (Fixed in:
6.54.1)
Code Analysis
Commit: d91c0fc
Fixed offer redemption to reject inactive offers (#29630)
@@ -467,6 +467,13 @@ module.exports = class RouterController {
});
}
+ if (offer.status && offer.status !== 'active') {
+ throw new BadRequestError({
+ message: tpl(messages.offerArchived),
+ context: 'Offer with id "' + offerId + '" is no longer active'
+ });
+ }
+
if (!offer.tier) {
throw new BadRequestError({
message: 'Offer does not have a tier'
Mitigation Strategies
- Upgrade to Ghost CMS version 6.54.1 or higher.
- Manually archive or delete corresponding coupon codes in the Stripe Dashboard.
- Monitor API logs for recurring checkout failures associated with archived offer IDs.
Remediation Steps:
- Identify the current running version of Ghost CMS.
- Execute 'ghost update' to pull the latest security release (6.54.1 or newer).
- Log into the Stripe dashboard connected to the Ghost instance.
- Verify that old promotional coupon codes are fully deactivated directly in Stripe.
References
Read the full report for CVE-2026-70589 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)