CVE-2026-59817: Premium Membership Provisioning Bypass via Parameter Tampering in Ghost CMS

Ghost is an open-source content management system built on Node.js that enables subscription-based monetization, membership routing, and donations using Stripe. The platform relies on Stripe's hosted Checkout Sessions to securely handle credit card processing. The checkout flow handles operations such as purchasing premium memberships, processing single donations, and issuing gift cards.

To map these detached operations back to internal states, the CMS registers critical transaction parameters directly into Stripe's checkout session metadata. This architectural design relies on Stripe Webhooks to asynchronously inform the server which specific entitlements must be granted once payment is confirmed. This framework introduces an attack surface when user-supplied input parameters are processed without validation prior to payment initialization.

The flaw indexed as CVE-2026-59817 represents a classic parameter tampering and business logic bypass vulnerability in the routing of donation payments. Due to improper metadata sanitization, unauthenticated remote actors can inject control keys into Stripe sessions. When Stripe confirms payment completion, the backend accepts the modified metadata as authentic, resulting in privilege escalation.

The root cause of CVE-2026-59817 is a multi-step input validation and logical routing failure in the Ghost backend components handling member checkouts. The flow begins when a user initiates a donation payment through the public REST endpoint mapped to the _createDonationCheckoutSession controller function.

First, the application failed to verify if the donations feature was actually toggled on by administrators. It verified only if the Stripe service was structurally configured, allowing users to reach the donation setup codepath even on deployments where donations were disabled. This oversight granted access to an unauthenticated, arbitrary-amount checkout path.

Second, the controller did not enforce metadata boundaries. During session creation, the incoming HTTP request payload allowed arbitrary keys to be placed inside the metadata object. Because the controller did not sanitize or blocklist reserved internal identifiers, these keys were forwarded to the Stripe API and appended to the valid Stripe Session.

Finally, when Stripe transmitted the asynchronous checkout.session.completed event, the webhook consumer parsed the returned metadata to determine how to process the transaction. Rather than validating that the subscription purchase price matched the financial total processed, the handler executed routing solely based on the presence of boolean flags inside the metadata. This allowed a low-value donation payment to be routed to gift-subscription code paths.

Analyzing the source code diff reveals how the validation gaps were closed. The primary flaw was localized within router-controller.js and mitigated by enforcing configuration checks and stripping control tags.

The vulnerability is mitigated by implementing a strict set of reserved keys and introducing a validation check to guarantee that donations are actively enabled. Below is the code implementation showing the introduced metadata blocklist:

// Patched: Define reserved metadata keys that control application state
const RESERVED_CHECKOUT_METADATA_KEYS = new Set([
    'ghost_donation',
    'ghost_gift',
    'ghostSignupContext',
    'gift_token',
    'tier_id',
    'cadence',
    'duration'
]);
 
// Patched: Explicit sanitization function to strip reserved attributes
function removeReservedCheckoutMetadata(metadata) {
    if (!metadata || typeof metadata !== 'object') {
        return;
    }
    for (const key of RESERVED_CHECKOUT_METADATA_KEYS) {
        delete metadata[key];
    }
}

The corresponding webhook receiver in checkout-session-event-service.js was also patched to enforce strict boolean evaluations on Stripe metadata fields and prevent conflicting states. It now logs a warning and rejects executions where conflicting flow markers are present:

// Patched: Enforce strict type check on webhook processing
function isStripeMetadataTrue(value) {
    return value === true || value === 'true';
}
 
function hasConflictingCheckoutFlowMetadata(metadata) {
    return hasStripeMetadataKey(metadata, 'ghost_donation') && hasStripeMetadataKey(metadata, 'ghost_gift');
}

To exploit this vulnerability, an attacker identifies a target site running a vulnerable version of Ghost CMS and locates the endpoint for creating checkout sessions. The attack requires no authentication or valid cookie credentials.

The attacker crafts a POST request to /api/create-stripe-checkout-session/ with the transaction type configured to donation. This allows the attacker to specify an arbitrary nominal value, such as $1.00. The attacker embeds reserved parameter fields within the unsanitized metadata nested object, simulating a valid paid gift subscription configuration.

{
  "customerEmail": "attacker@example.com",
  "type": "donation",
  "amount": 100,
  "successUrl": "https://example.com/success",
  "cancelUrl": "https://example.com/cancel",
  "metadata": {
    "ghost_gift": "true",
    "gift_token": "attacker_controlled_token_string",
    "tier_id": "prod_premium_tier_id",
    "cadence": "year",
    "duration": "12"
  }
}

The vulnerable server accepts this payload, generates a Stripe checkout session link containing the tampered metadata, and returns it to the attacker. The attacker completes the Stripe payment flow of $1.00. The Stripe event processor issues a webhook to Ghost, which identifies ghost_gift: "true" in the metadata, bypasses the payment tier check, and provisions a 12-month premium access token to the designated email.

The impact of CVE-2026-59817 is localized privilege escalation and monetary evasion, with a CVSS v3.1 score of 5.3 (Medium). The flaw does not present a mechanism for remote code execution, command injection, or administrative panel access, nor does it allow access to back-end system databases.

The operational impact is restricted to the bypass of premium content subscription fees. Threat actors can use the vulnerability to obtain active, long-term premium memberships without paying the defined registration fees, leading to revenue loss for creators and publishing entities using the platform.

Because the vulnerability is confined to CMS billing logic, no customer records, payment details, or personal identifying information are leaked or modified. It does not affect system-level availability or service reliability.

The definitive remediation is to upgrade Ghost CMS to version 6.44.0 or newer. This update implements input scrubbing for public-facing Stripe endpoints and hardens the asynchronous validation of metadata properties within the Stripe webhook controllers.

If upgrading is not immediately possible, administrators should disable the Tips and Donations feature globally in the Ghost management console. This limits the ability of external actors to trigger custom-amount payment processes.

Administrators may also apply Web Application Firewall rules at the CDN or proxy layer (such as Cloudflare or Nginx) to inspect and block POST requests to /api/create-stripe-checkout-session/ if the payload contains any keys in the metadata object matching ghost_gift, gift_token, or tier_id.