{"answers":{"affected":"4 open source packages ship an affected version, including ghost.","exploited":"There is no known exploitation of GHSA-65p7-pjj8-ggmr in the wild and no public exploit code.","fix":"Upgrade ghost to a fixed version for your release line: 3.42.6 or 4.15.1.","what":"GHSA-65p7-pjj8-ggmr is an authentication bypass vulnerability in ghost, published on 23 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-65p7-pjj8-ggmr and fix it if it is affected.\n\nWhat it is: GHSA-65p7-pjj8-ggmr is an authentication bypass vulnerability in ghost, published on 23 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-65p7-pjj8-ggmr in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- ghost (npm): affected from 3.18.0; fixed in 3.42.6\n- ghost (npm): affected from 3.18.0; fixed in 3.42.6\n- ghost (npm): affected from 4.0.0; fixed in 4.15.1\n- ghost (npm): affected from 4.0.0; fixed in 4.15.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-65p7-pjj8-ggmr/ (Markdown: https://insights.sbomify.com/GHSA-65p7-pjj8-ggmr/index.md)","id":"GHSA-65p7-pjj8-ggmr","markdown":"https://insights.sbomify.com/GHSA-65p7-pjj8-ggmr/index.md","name":"GHSA-65p7-pjj8-ggmr","record":{"aliases":[],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["account_takeover"],"network_reachable":"yes","non_default_config":true,"product_category":"Ghost blog platform","requires_auth":"none","summary":"Unauthenticated attackers can take over member accounts by changing their email addresses via a vulnerable API endpoint in Ghost.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\n\nAn error in the implementation of the member email change functionality allows unauthenticated users to change the email address of arbitrary member accounts to one they control by crafting a request to the relevant API endpoint, and validating the new address via magic link sent to the new email address.\n\nGhost(Pro) has already been patched. Self-hosters are impacted if running Ghost a version between 3.18.0 and 4.15.0 with members functionality enabled.\n\n### Patches\n\nFixed in 4.15.1, all 4.x sites should upgrade as soon as possible.\nFixed in 3.42.6, all 3.x sites should upgrade as soon as possible.\n\n### Workarounds\n\nThe patch in 4.15.1 and 3.42.6 adds a new authenticated endpoint for updating member email addresses. Updating Ghost is the quickest complete solution.\n\nAs a workaround, if for any reason you cannot update your Ghost instance, you can block the `POST /members/api/send-magic-link/` endpoint, which will also disable member login and signup for your site.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Email us at [security@ghost.org](mailto:security@ghost.org)","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Member account takeover","id":"GHSA-65p7-pjj8-ggmr","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"auth_bypass","year":"2021"},"n_packages":4,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["3.42.6"],"introduced":["3.18.0"],"last_affected":[],"package":"ghost","purl":null,"source":"GHSA-65p7-pjj8-ggmr"},{"ecosystem":"npm","fixed":["3.42.6"],"introduced":["3.18.0"],"last_affected":[],"package":"ghost","purl":"pkg:npm/ghost","source":"GHSA-65p7-pjj8-ggmr"},{"ecosystem":"npm","fixed":["4.15.1"],"introduced":["4.0.0"],"last_affected":[],"package":"ghost","purl":null,"source":"GHSA-65p7-pjj8-ggmr"},{"ecosystem":"npm","fixed":["4.15.1"],"introduced":["4.0.0"],"last_affected":[],"package":"ghost","purl":"pkg:npm/ghost","source":"GHSA-65p7-pjj8-ggmr"}],"products":null,"published":"2021-09-23","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Unauthenticated attackers can take over member accounts by changing their email addresses via a vulnerable API endpoint in Ghost.","url":"https://insights.sbomify.com/GHSA-65p7-pjj8-ggmr/"}