Advisories for Npm/@Tryghost/Portal package

An attacker was able to craft a malicious link that, when accessed by an authenticated staff user or member, would execute JavaScript with the victim's permissions, potentially leading to account takeover.

Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information.