Listen to this Post
How CVE-2026-59817 Works
This vulnerability resides in Ghost’s public donation checkout flow, introduced in version 6.27.0 and persisting until 6.43.1. The core issue is improper authentication on the donation endpoint combined with insufficient validation of checkout metadata.
Ghost allows site administrators to enable a “Tips & donations” feature, which generates a public checkout URL for accepting one-time payments. When a user initiates a donation, the system creates a checkout session with metadata specifying the donation amount, the recipient member, and crucially, whether the payment should result in a gift membership being issued to a specified email address.
An unauthenticated attacker can intercept or craft the donation checkout request and manipulate the metadata parameters. By altering the `amount` field to a minimal value (e.g., $1 or even $0.01) while keeping the `gift` and `member` fields intact, the attacker tricks the system into processing the transaction as a valid full-price gift membership purchase. Because the endpoint lacks proper authorization checks to verify that the payment amount matches the actual gift membership price, the system issues a full, paid gift membership to any email address the attacker specifies.
The attack requires no authentication and no user interaction. It does not expose customer or member data, nor can it be used to steal money from the site or its members. However, it allows an attacker to grant themselves or others unlimited, fully paid gift memberships at a fraction of the cost, effectively bypassing the site’s paid membership revenue model.
The vulnerability is classified as External Control of Assumed-Immutable Web Parameter (CWE-472), with a CVSS v3.1 base score of 5.3 (Medium). The fix in version 6.44.0 introduces stricter parameter validation and authorization checks within the donation checkout process, ensuring that only properly authenticated users can create gift memberships with full payment privileges.
DailyCVE Form
Platform: Ghost CMS
Version: 6.27.0 to 6.43.1
Vulnerability: Metadata manipulation
Severity: Medium (CVSS 5.3)
Date: 2026-07-10
Prediction: Patch expected 2026-07-10
What Undercode Say: Analytics
The vulnerability affects all self-hosted Ghost instances with the “Tips & donations” feature enabled. Ghost(Pro) customers are automatically updated and were not affected.
Vulnerable endpoint detection (Bash):
Check if your Ghost instance is vulnerable curl -s https://your-ghost-domain.com/members/api/donations/ | grep -i "gift"
Check installed version:
For Ghost-CLI installations
ghost version
For Docker installations
docker exec -it ghost-container node -p "require('./package.json').version"
Exploit simulation (conceptual – do not use maliciously):
Craft a minimal payment request with gift membership metadata
curl -X POST https://target-ghost.com/members/api/donations/ \
-H "Content-Type: application/json" \
-d '{"amount":0.01,"gift":true,"recipient":"[email protected]"}'
Patch verification:
After upgrading to 6.44.0, verify the fix curl -s https://your-ghost-domain.com/members/api/donations/ | grep -i "authorization"
Exploit
An unauthenticated attacker can:
- Identify a Ghost instance running a vulnerable version (6.27.0–6.43.1)
- Locate the public donation checkout endpoint (typically
/members/api/donations/) - Intercept or craft a POST request to this endpoint
- Modify the `amount` parameter to a minimal value while retaining `gift` and `recipient` parameters
5. Submit the request without any authentication headers
- Receive a fully valid gift membership for the specified email address
The attack requires no special privileges, no user interaction, and can be executed entirely over the network.
Protection
Immediate (Workaround):
- Disable the donations feature in Ghost Admin: Settings → Membership → Tips & donations
Permanent (Patch):
- Upgrade to Ghost v6.44.0 or later
- Docker: Pull the latest official image and restart the container
- Ghost-CLI: Run `ghost update` to upgrade to the latest version
- For self-hosted instances, ensure regular updates to receive security patches
Verification:
- After patching, confirm the version by checking the admin panel footer or running `ghost version`
– Monitor donation-related logs for unusual activity patterns
Impact
- Business Impact: Attackers can obtain full paid gift memberships at minimal cost, bypassing the site’s paid membership revenue model
- Data Exposure: None – no customer or member data is exposed
- Financial Theft: Not possible – the issue cannot be used to steal money from the site or its members
- Scope: Affects all self-hosted Ghost instances from v6.27.0 through v6.43.1
- Ghost(Pro): Not affected – automatically updated to fixed versions
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
