CVE-2026-103266: Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification
Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to an existing member, modify that member's name, and inject content into newsletters sent to the member. Depending on the recipient's email client, the injected content may be rendered, resulting in HTML injection or cross-site scripting (XSS).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghostto a version that resolves this vulnerability.Fixed in 6.62.0
Event History
Frequently Asked Questions
Which Ghost versions are affected?
Ghost versions 5.2.0 through versions before 6.62.0 are affected. Updating to 6.62.0 or later removes the affected version range.
Does an attacker need an account to exploit this?
No. The issue can be abused remotely without authentication through the Stripe Checkout flow. The CVSS vector indicates that user interaction is required, but the available data does not specify the exact interaction needed.
What should teams investigate after identifying an affected deployment?
Review member records for unexpected paid subscriptions or name changes, and inspect newsletters sent to members for untrusted injected content. Recipients using email clients that render the injected content may be exposed to HTML injection or cross-site scripting.