Unauthenticated Input Manipulation in Ghost CMS Donation Checkout

CVE-2026-59817

What is CVE-2026-59817?

Ghost CMS, a Node.js-based content management system, contains a vulnerability in its public donation checkout flow that allows an unauthenticated attacker to modify donation checkout metadata. This exploitation leads to unauthorized obtaining of paid gift memberships for a minimal payment, circumventing any direct theft of customer or member data. The issue has been resolved in version 6.44.0, which mitigates the risk associated with this manipulation flaw.

References