CVE-2026-70589: Improper Status Validation in Ghost CMS Offer Redemption

Vulnerability ID: CVE-2026-70589
CVSS Score: 4.8
Published: 2026-08-04

A business logic vulnerability in Ghost CMS allows unauthenticated remote users to redeem deactivated or archived promotional subscription offers by programmatically passing old offer identifiers during the checkout session initialization.

TL;DR

Unauthenticated users can bypass UI-level status checks to redeem archived promotional discount offers, resulting in unauthorized pricing discounts during membership checkout.

Technical Details

• CWE ID: CWE-20
• Attack Vector: Network
• CVSS Base Score: 4.8
• Impact: Unauthorized Pricing Discounts / Membership Manipulation
• Exploit Status: No Public Exploit
• KEV Status: Not Listed

Affected Systems

• Ghost CMS Core Subscription Subsystem
• Ghost: >= 4.22.0, < 6.54.1 (Fixed in: 6.54.1)

Code Analysis

Commit: d91c0fc

Fixed offer redemption to reject inactive offers (#29630)

@@ -467,6 +467,13 @@ module.exports = class RouterController {
                 });
             }

+            if (offer.status && offer.status !== 'active') {
+                throw new BadRequestError({
+                    message: tpl(messages.offerArchived),
+                    context: 'Offer with id "' + offerId + '" is no longer active'
+                });
+            }
+
             if (!offer.tier) {
                 throw new BadRequestError({
                     message: 'Offer does not have a tier'

Mitigation Strategies

• Upgrade to Ghost CMS version 6.54.1 or higher.
• Manually archive or delete corresponding coupon codes in the Stripe Dashboard.
• Monitor API logs for recurring checkout failures associated with archived offer IDs.

Remediation Steps:

1. Identify the current running version of Ghost CMS.
2. Execute 'ghost update' to pull the latest security release (6.54.1 or newer).
3. Log into the Stripe dashboard connected to the Ghost instance.
4. Verify that old promotional coupon codes are fully deactivated directly in Stripe.

References

• Official GitHub Security Advisory
• Official Technical Fix Commit
• CVE Registry Record

Read the full report for CVE-2026-70589 on our website for more details including interactive diagrams and full exploit analysis.