Member Account Takeover in Ghost
Summary
GHSA-65p7-pjj8-ggmr: Member account takeover. Affects ghost across 2 version ranges.
>= 3.18.0, < 3.42.6
>= 4.0.0, < 4.15.1
Fixed in 3.42.6 or 4.15.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghost is an open-source publishing platform that is designed for building and managing websites. It provides a range of features, including content management, themes, and member functionality. The member functionality allows users to create accounts, log in, and perform various actions related to their accounts. However, a vulnerability has been discovered in Ghost that allows unauthenticated users to take over member accounts by changing the email address associated with the account.
Vulnerability Detail
The vulnerability in Ghost allows unauthenticated users to change the email address of arbitrary member accounts to an email address they control. This can be achieved by crafting a request to the relevant API endpoint and validating the new address via a magic link sent to the new email address. The impact of this vulnerability is significant as it allows unauthorized access to member accounts, potentially leading to unauthorized actions, data breaches, or other malicious activities. The vulnerability affects self-hosted instances of Ghost running versions between 3.18.0 and 4.15.0 with the members functionality enabled.
How To Fix
Latest published version: 6.72.0 as of 22 Oct 2026
npm install ghost@6.72.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.18.0, < 3.42.63.42.6npm install ghost@3.42.6 -
>= 4.0.0, < 4.15.14.15.1npm install ghost@4.15.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Ghost is not immediately feasible, a workaround is available. By blocking the POST /members/api/send-magic-link/ endpoint, the vulnerability can be mitigated. However, this workaround will also disable member login and signup functionality on the site. It is important to note that this is a temporary solution and upgrading Ghost should still be prioritized to fully address the vulnerability.
Conclusion
The vulnerability in Ghost allows unauthenticated users to take over member accounts by changing the email address associated with the accounts. Upgrading Ghost to the patched versions is the recommended solution to address this vulnerability. If immediate upgrade is not possible, blocking the specific API endpoint can serve as a temporary workaround. For further assistance and support in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ghost →
FAQ
The vulnerability allows unauthenticated users to change the email address of member accounts, potentially leading to unauthorized access and malicious activities.
Self-hosted instances of Ghost running versions between 3.18.0 and 4.15.0 with the members functionality enabled are affected.
The recommended solution is to upgrade Ghost to the patched versions: 4.15.1 or later for Ghost 4.x sites, and 3.42.6 or later for Ghost 3.x sites.
If upgrading Ghost is not feasible at the moment, you can block the POST /members/api/send-magic-link/ endpoint as a temporary workaround. However, this will disable member login and signup functionality.
For more information, you can email security@ghost.org.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
