CVE-2026-70589: Ghost: Archived Offers can be Redeemed

August 4, 2026

A missing validation check allowed users to redeem subscription offers that were no longer active.

References

github.com/TryGhost/Ghost/commit/d91c0fc52dfc987d71a9803dbcbe6447d21b92fb
github.com/TryGhost/Ghost/security/advisories/GHSA-4wx2-7gvj-qfq3
github.com/advisories/GHSA-4wx2-7gvj-qfq3
nvd.nist.gov/vuln/detail/CVE-2026-70589

Code Behaviors & Features

Detect and mitigate CVE-2026-70589 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →