CVE-2024-43409: Ghost's improper authentication allows access to member information and actions

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-08-20 · updated 2026-06-17
Weakness: CWE-284

Description

Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. This security vulnerability is present in Ghost v4.46.0-v5.89.4. v5.89.5 contains a fix for this issue.

Affected products

TryGhost Ghost: from 4.46.0 before 5.89.5 — fixed in 5.89.5

How to fix

Upgrade to a fixed version: TryGhost Ghost 5.89.5. Check the vendor advisory for mitigations.

References

https://github.com/TryGhost/Ghost/commit/dac25612520b571f58679764ecc27109e641d1db
https://github.com/TryGhost/Ghost/security/advisories/GHSA-78x2-cwp9-5j42

Get alerted when CVE-2024-43409 or the next vulnerability affects your stack