CVE-2026-70589: Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validation check allowed users to rede…
Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offers that were no longer active. This issue is fixed in version 6.54.1.
- Published by source
- 2026-08-04
- First seen by Reality Radar
- 2026-10-24
- Last verified
- 2026-10-24
What the official notice says
Risk: CVSS 4.8
Is this affecting you?
Add what you own or use and Reality Radar will tell you when official changes match it — with evidence and next steps.
Sources
- NIST National Vulnerability Database Tier A · official published 2026-08-04
Evidence ledger
Every piece of evidence we store is appended to a public hash chain, so later edits are detectable. Anyone can re-verify it.
| Entry | Kind | Observed | Evidence hash | Entry hash |
|---|---|---|---|---|
| #1523 | new | 2026-10-24 | 898a44e9d99f…3fca01 | ce36b9c1cfbd…90df89 |
Chain head: #1565 7d9afd922511…68b9c7