CVE-2024-43409
Ghost's improper authentication allows access to member information and actions
Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. This security vulnerability is present in Ghost v4.46.0-v5.89.4. v5.89.5 contains a fix for this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Ghost's improper authentication allows access to member information and actions
Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. This security vulnerability is present in Ghost v4.46.0-v5.89.4. v5.89.5 contains a fix for this issue.
- Record
CVE-2024-43409- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2024-2525
Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. This security vulnerability is present in Ghost v4.46.0-v5.89.4. v5.89.5 contains a fix for this issue.
- Record
EUVD-2024-2525- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-78x2-cwp9-5j42
Ghost's improper authentication allows access to member information and actions
Impact
Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information.
Vulnerable versions
This security vulnerability is present in Ghost v4.46.0-v5.89.5.
Ghost(Pro) customers are automatically updated to fixed versions ahead of disclosure.
If you're a self-hoster, please follow our update instructions.
Patches
v5.89.5 contains a fix for this issue.
Workarounds
Disable site membership in Ghost settings.
For more information
If you have any questions or comments about this advisory:
- Email us at [email protected]
- Record
GHSA-78x2-cwp9-5j42- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-284, CWE-287
- Updated
- 2026-11-02
NVD
Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. This security vulnerability is present in Ghost v4.46.0-v5.89.4. v5.89.5 contains a fix for this issue.
- Record
CVE-2024-43409- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-284, CWE-287
- Updated
- 2026-11-02
OSV
Ghost's improper authentication allows access to member information and actions
Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. This security vulnerability is present in Ghost v4.46.0-v5.89.4. v5.89.5 contains a fix for this issue.
- Record
CVE-2024-43409- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-78x2-cwp9-5j42
Ghost's improper authentication allows access to member information and actions
Impact
Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information.
Vulnerable versions
This security vulnerability is present in Ghost v4.46.0-v5.89.5.
Ghost(Pro) customers are automatically updated to fixed versions ahead of disclosure.
If you're a self-hoster, please follow our update instructions.
Patches
v5.89.5 contains a fix for this issue.
Workarounds
Disable site membership in Ghost settings.
For more information
If you have any questions or comments about this advisory:
- Email us at [email protected]
- Record
GHSA-78x2-cwp9-5j42- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-284, CWE-287
- Updated
- 2026-11-02
OSVBIT-ghost-2024-43409 No score
Ghost's improper authentication allows access to member information and actions
Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. This security vulnerability is present in Ghost 4.46.0 through 5.89.4. v5.89.5 contains a fix for this issue.
- Record
BIT-ghost-2024-43409- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ghostnpm |
4.46.0 up to 5.89.5 | 5.89.5 |
@tryghost/portalnpm |
1.22.2 up to 2.39.0 | 2.39.0 |
ghostBitnami |
4.46.0 up to 5.89.5 | 5.89.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-43409 is a medium vulnerability (CVSS 6.5) in Ghost, published August 20, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in ghost 5.89.5.
References
github.com/TryGhost/Ghost/security/advisories/GHSA-78x2-cwp9-5j42
nvd.nist.gov/vuln/detail/CVE-2024-43409