Headline

GHSA-78x2-cwp9-5j42: Ghost's improper authentication allows access to member information and actions

Impact

Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information.

Vulnerable versions

This security vulnerability is present in Ghost v4.46.0-v5.89.5.

Patches

v5.89.5 contains a fix for this issue.

Workarounds

None.

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]

3 months ago

ghsa

Open in Source

#vulnerability #nodejs #git #auth

Package

npm @tryghost/portal (npm)

Affected versions

>= 1.22.2, < 2.39.0

Patched versions

2.39.0

npm ghost (npm)

>= 4.46.0, < 5.89.5

5.89.5

Description

Impact

Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information.

Vulnerable versions

This security vulnerability is present in Ghost v4.46.0-v5.89.5.

Patches

v5.89.5 contains a fix for this issue.

Workarounds

None.

For more information

If you have any questions or comments about this advisory: