{"vulnerability": "cve-2026-7058", "sightings": [{"uuid": "4df66b13-b847-4624-830e-bd29271014b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70589", "type": "seen", "source": "https://gist.github.com/alon710/8a67496a2aeb5dc5719baf5a0f706ea5", "content": "# CVE-2026-70589: CVE-2026-70589: Improper Status Validation in Ghost CMS Offer Redemption\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70589\n\n## Summary\nA business logic vulnerability in Ghost CMS allows unauthenticated remote users to redeem deactivated or archived promotional subscription offers by programmatically passing old offer identifiers during the checkout session initialization.\n\n## TL;DR\nUnauthenticated users can bypass UI-level status checks to redeem archived promotional discount offers, resulting in unauthorized pricing discounts during membership checkout.\n\n## Technical Details\n\n- **CWE ID**: CWE-20\n- **Attack Vector**: Network\n- **CVSS Base Score**: 4.8\n- **Impact**: Unauthorized Pricing Discounts / Membership Manipulation\n- **Exploit Status**: No Public Exploit\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ghost CMS Core Subscription Subsystem\n- **Ghost**: >= 4.22.0, < 6.54.1 (Fixed in: `6.54.1`)\n\n## Mitigation\n\n- Upgrade to Ghost CMS version 6.54.1 or higher.\n- Manually archive or delete corresponding coupon codes in the Stripe Dashboard.\n- Monitor API logs for recurring checkout failures associated with archived offer IDs.\n\n**Remediation Steps:**\n1. Identify the current running version of Ghost CMS.\n2. Execute 'ghost update' to pull the latest security release (6.54.1 or newer).\n3. Log into the Stripe dashboard connected to the Ghost instance.\n4. Verify that old promotional coupon codes are fully deactivated directly in Stripe.\n\n## References\n\n- [Official GitHub Security Advisory](https://github.com/TryGhost/Ghost/security/advisories/GHSA-4wx2-7gvj-qfq3)\n- [Official Technical Fix Commit](https://github.com/TryGhost/Ghost/commit/d91c0fc52dfc987d71a9803dbcbe6447d21b92fb)\n- [CVE Registry Record](https://www.cve.org/CVERecord?id=CVE-2026-70589)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70589) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T09:31:26.083497Z"}, {"uuid": "10980635-fe55-4bff-aa1f-03ead99884a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70588", "type": "seen", "source": "https://gist.github.com/alon710/98861561e950349ba52fdd407f74f7c8", "content": "# CVE-2026-70588: CVE-2026-70588: Stored Cross-Site Scripting via Universal Import in Ghost CMS\n\n> **CVSS Score:** 5.0\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70588\n\n## Summary\nCVE-2026-70588 is a stored Cross-Site Scripting (XSS) vulnerability in Ghost CMS versions 5.26.0 through 6.54.0. The vulnerability exists within the Universal Import feature of the Ghost Admin interface. When processing imported content from third-party platforms such as Revue, the importer fails to sanitize user-controlled HTML tags, rich-text structured JSON, or link fields before rendering them in the Ghost Admin panel and front-end template rendering contexts.\n\n## TL;DR\nA stored Cross-Site Scripting (XSS) vulnerability in Ghost CMS (versions 5.26.0 to 6.54.0) allows administrative users to inject malicious scripts via the Universal Import feature, leading to administrative session hijacking when other users view the imported content.\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network\n- **CVSS Severity**: 5.0 (Medium)\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ghost CMS\n- **Ghost**: >= 5.26.0, < 6.54.1 (Fixed in: `6.54.1`)\n\n## Mitigation\n\n- Upgrade Ghost CMS to version 6.54.1 or later to apply input sanitization and URL validation.\n- Restrict 'Administrator' and high-privileged roles to verified personnel to minimize rogue imports.\n- Deploy a Content Security Policy (CSP) to restrict inline script execution and enforce trusted endpoints.\n\n**Remediation Steps:**\n1. Access the host machine hosting the Ghost installation via SSH.\n2. Navigate to the Ghost installation root directory.\n3. Run the command 'ghost update' to pull the latest safe release.\n4. Execute database queries to check for existing script injections in image captions or post contents.\n5. Sanitize or remove any flagged database entries manually if malicious records are identified.\n\n## References\n\n- [GitHub Security Advisory GHSA-2gx6-7gx2-wwcf](https://github.com/TryGhost/Ghost/security/advisories/GHSA-2gx6-7gx2-wwcf)\n- [Fix Commit a8bea3a4](https://github.com/TryGhost/Ghost/commit/a8bea3a4ceec4c852b880f4885119453c3d8588e)\n- [Ghost Pull Request 29635](https://github.com/TryGhost/Ghost/pull/29635)\n- [Ghost Release Tag v6.54.1](https://github.com/TryGhost/Ghost/releases/tag/v6.54.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70588) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T11:31:33.317557Z"}]}