Most recent entries from all

BIT-ghost-2024-43409 — Ghost's improper authentication allows access to member information and actions

Affected: Bitnami: ghost

Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. This security vulnerability is present in Ghost 4.46.0 through 5.89.4. v5.89.5 contains a fix for this issue.

EUVD-2026-161040

fkie_cve-2024-43409

Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. This security vulnerability is present in Ghost v4.46.0-v5.89.4. v5.89.5 contains a fix for this issue.

GHSA-78x2-cwp9-5j42 — Ghost's improper authentication allows access to member information and actions

Affected: npm: ghost, npm: @tryghost/portal

### Impact

Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information.

### Vulnerable versions

This security vulnerability is present in Ghost v4.46.0-v5.89.5.

Ghost(Pro) customers are automatically updated to fixed versions ahead of disclosure.

If you're a self-hoster, please follow our [update instructions](https://ghost.org/docs/update).

### Patches

v5.89.5 contains a fix for this issue.

### Workarounds

Disable site membership in Ghost settings.

### For more information

If you have any questions or comments about this advisory:

* Email us at [security@ghost.org](mailto:security@ghost.org)