{"id":"CVE-2024-43409","aliases":["BIT-ghost-2024-43409","EUVD-2024-2525","GHSA-78x2-cwp9-5j42"],"status":"published","title":"Ghost's improper authentication allows access to member information and actions","description":"Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. This security vulnerability is present in Ghost v4.46.0-v5.89.4. v5.89.5 contains a fix for this issue.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00322,"percentile":0.25383,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284","CWE-287"],"published":"2024-08-20T15:05:04Z","modified":"2026-10-28T02:30:25Z","fixes":[{"ecosystem":"npm","package":"ghost","fixed_in":["5.89.5"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@tryghost/portal","fixed_in":["2.39.0"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"ghost","fixed_in":["5.89.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"ghost","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.46.0"},{"fixed":"5.89.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@tryghost/portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.22.2"},{"fixed":"2.39.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"ghost","ranges":[{"type":"SEMVER","events":[{"introduced":"4.46.0"},{"fixed":"5.89.5"}]}]},{"source":"osv","ecosystem":"npm","package":"ghost","ranges":[{"type":"SEMVER","events":[{"introduced":"4.46.0"},{"fixed":"5.89.5"}]}]},{"source":"osv","ecosystem":"npm","package":"@tryghost/portal","ranges":[{"type":"SEMVER","events":[{"introduced":"1.22.2"},{"fixed":"2.39.0"}]}]}],"products":[{"vendor":"ghost","product":"ghost"},{"vendor":"tryghost","product":"ghost"}],"references":[{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-78x2-cwp9-5j42","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/TryGhost/Ghost/commit/dac25612520b571f58679764ecc27109e641d1db","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43409","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-78x2-cwp9-5j42"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43409.json","tags":["advisory"]},{"url":"https://github.com/TryGhost/Ghost","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-43409","title":"Ghost's improper authentication allows access to member information and actions","description":"Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. This security vulnerability is present in Ghost v4.46.0-v5.89.4. v5.89.5 contains a fix for this issue.","status":"published","published":"2024-08-20T15:05:04.338Z","modified":"2024-09-03T14:58:35.797Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:33:58.839967Z"}],"euvd":[{"id":"EUVD-2024-2525","description":"Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. This security vulnerability is present in Ghost v4.46.0-v5.89.4. v5.89.5 contains a fix for this issue.","status":"published","published":"2024-08-20T15:05:04Z","modified":"2024-09-03T14:58:35Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:56:06.067403Z"}],"ghsa":[{"id":"GHSA-78x2-cwp9-5j42","title":"Ghost's improper authentication allows access to member information and actions","description":"### Impact\n\nImproper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information.\n\n### Vulnerable versions\n\nThis security vulnerability is present in Ghost v4.46.0-v5.89.5.\n\nGhost(Pro) customers are automatically updated to fixed versions ahead of disclosure.\n\nIf you're a self-hoster, please follow our [update instructions](https://ghost.org/docs/update).\n\n### Patches\n\nv5.89.5 contains a fix for this issue.\n\n### Workarounds\n\nDisable site membership in Ghost settings.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Email us at [security@ghost.org](mailto:security@ghost.org)\n","status":"published","published":"2024-08-20T20:04:49Z","modified":"2024-10-29T20:00:43Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-284","CWE-287"],"updated_at":"2026-11-02T14:38:14.769863Z"}],"nvd":[{"id":"CVE-2024-43409","description":"Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. This security vulnerability is present in Ghost v4.46.0-v5.89.4. v5.89.5 contains a fix for this issue.","status":"published","published":"2024-08-20T15:15:24.27Z","modified":"2026-06-17T07:50:59.443Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-284","CWE-287"],"updated_at":"2026-11-02T14:10:19.870727Z"}],"osv":[{"id":"CVE-2024-43409","title":"Ghost's improper authentication allows access to member information and actions","description":"Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. This security vulnerability is present in Ghost v4.46.0-v5.89.4. v5.89.5 contains a fix for this issue.","status":"published","published":"2024-08-20T15:05:04.338Z","modified":"2026-10-28T02:30:25.023758151Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:44:42.322107Z"},{"id":"GHSA-78x2-cwp9-5j42","title":"Ghost's improper authentication allows access to member information and actions","description":"### Impact\n\nImproper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information.\n\n### Vulnerable versions\n\nThis security vulnerability is present in Ghost v4.46.0-v5.89.5.\n\nGhost(Pro) customers are automatically updated to fixed versions ahead of disclosure.\n\nIf you're a self-hoster, please follow our [update instructions](https://ghost.org/docs/update).\n\n### Patches\n\nv5.89.5 contains a fix for this issue.\n\n### Workarounds\n\nDisable site membership in Ghost settings.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Email us at [security@ghost.org](mailto:security@ghost.org)\n","status":"published","published":"2024-08-20T20:04:49Z","modified":"2024-10-29T20:00:41Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-284","CWE-287"],"updated_at":"2026-11-02T15:46:40.657155Z"},{"id":"BIT-ghost-2024-43409","title":"Ghost's improper authentication allows access to member information and actions","description":"Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. This security vulnerability is present in Ghost 4.46.0 through 5.89.4. v5.89.5 contains a fix for this issue.","status":"published","published":"2024-08-23T07:18:19.005Z","modified":"2026-09-08T08:47:33.290444093Z","updated_at":"2026-11-02T15:28:29.999658Z"}]}}