-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ghost | npm | >= 5.0.0, < 5.22.7 | 5.22.7 |
| ghost | npm | >= 4.46.0, < 4.48.8 | 4.48.8 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the updateMemberData function in middleware.js which directly picks 'newsletters' from req.body (via _.pick) and passes it to the update method. This allows members to manipulate newsletter relationships despite lacking privileges. The Talos report explicitly references this function and its handling of the newsletters relationship as the root cause, with code evidence showing missing access controls for nested newsletter objects in member updates.
Ongoing coverage of React2Shell