{"id":"EUVD-2026-42658","enisaUuid":"94f543f9-209b-3e57-a130-380daeedad09","description":"Ghost is a Node.js content management system. From 6.27.0 before 6.44.0, Ghost\u0027s public donation checkout flow allowed an unauthenticated attacker to control donation checkout metadata and obtain full paid gift memberships for a minimal payment without exposing customer or member data or stealing money from a site or its members. This issue is fixed in version 6.44.0.","datePublished":"Jul 9, 2026, 5:40:15 PM","dateUpdated":"Jul 14, 2026, 1:04:55 AM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-xm43-3m56-w3wf\nhttps://github.com/TryGhost/Ghost/pull/28351\nhttps://github.com/TryGhost/Ghost/pull/28352\nhttps://github.com/TryGhost/Ghost/commit/cab716cd015ac04b7ee50c7a405478d97bc7b1e0\nhttps://github.com/TryGhost/Ghost/commit/ee7b991b466a7849c70f9d1caed8e491ee4113c6\n","aliases":"CVE-2026-59817\nGHSA-xm43-3m56-w3wf\n","assigner":"GitHub_M","epss":0.4,"enisaIdProduct":[{"id":"cfa17339-9d9c-3899-9c70-19c8a957d0bf","product":{"name":"Ghost","vendor":{"name":"TryGhost"}},"product_version":"6.27.0, \u003c 6.44.0"}],"enisaIdVendor":[{"id":"0c4b1aa4-3716-39ea-9cbd-b0875867d98b","vendor":{"name":"TryGhost"}}],"enisaIdVulnerability":[{"id":"b37895cd-3c2e-3984-8ef0-e5d6384b2555","vulnerability":{"id":"GHSA-xm43-3m56-w3wf","description":"Ghost: Paid gift memberships obtainable at minimal cost via the donations feature","datePublished":"Aug 4, 2026, 9:57:48 PM","dateUpdated":"Aug 4, 2026, 9:57:48 PM","baseScore":0.0,"references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-xm43-3m56-w3wf\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59817\nhttps://github.com/TryGhost/Ghost/pull/28351\nhttps://github.com/TryGhost/Ghost/pull/28352\nhttps://github.com/TryGhost/Ghost/commit/cab716cd015ac04b7ee50c7a405478d97bc7b1e0\nhttps://github.com/TryGhost/Ghost/commit/ee7b991b466a7849c70f9d1caed8e491ee4113c6\nhttps://github.com/TryGhost/Ghost\n","enisa_id":"EUVD-2026-42658\n","aliases":"CVE-2026-59817\nGHSA-xm43-3m56-w3wf\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:59:06 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f49e1e59-3be4-39ef-a938-9d3ddc98e98f","vulnerability":{"id":"CVE-2026-59817","description":"Ghost is a Node.js content management system. From 6.27.0 before 6.44.0, Ghost\u0027s public donation checkout flow allowed an unauthenticated attacker to control donation checkout metadata and obtain full paid gift memberships for a minimal payment without exposing customer or member data or stealing money from a site or its members. This issue is fixed in version 6.44.0.","datePublished":"Jul 9, 2026, 5:40:15 PM","dateUpdated":"Jul 14, 2026, 1:04:55 AM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-xm43-3m56-w3wf\nhttps://github.com/TryGhost/Ghost/pull/28351\nhttps://github.com/TryGhost/Ghost/pull/28352\nhttps://github.com/TryGhost/Ghost/commit/cab716cd015ac04b7ee50c7a405478d97bc7b1e0\nhttps://github.com/TryGhost/Ghost/commit/ee7b991b466a7849c70f9d1caed8e491ee4113c6\n","enisa_id":"EUVD-2026-42658\n","assigner":"GitHub_M","epss":0.4,"dataProcessed":"Oct 30, 2026, 7:17:41 AM","vulnerabilityProduct":[{"id":"12ee096a-ebc2-3109-964d-d78415e01983","product":{"name":"Ghost","vendor":{"name":"TryGhost"}},"product_version":"6.27.0, \u003c 6.44.0"}],"vulnerabilityVendor":[{"id":"d0d7f122-6114-3a13-8e8f-a0a2c1b686ba","vendor":{"name":"TryGhost"}}]}}],"enisaIdAdvisory":[]}