CVE-2026-70589: Ghost: Archived Offers can be Redeemed

August 4, 2026

A missing validation check allowed users to redeem subscription offers that were no longer active.

References

github.com/TryGhost/Ghost/commit/d91c0fc52dfc987d71a9803dbcbe6447d21b92fb
github.com/TryGhost/Ghost/security/advisories/GHSA-4wx2-7gvj-qfq3
github.com/advisories/GHSA-4wx2-7gvj-qfq3
nvd.nist.gov/vuln/detail/CVE-2026-70589

Code Behaviors & Features

Detect and mitigate CVE-2026-70589 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →