Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Ghost bug bounty programs

ghost.org Updated

Ghost runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
12
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Ghost runs.

  • Ghost

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

12 targets. 6 excluded.

  • https://ghost.org

    Web

  • Email sending and newsletter delivery, covering recipient selection and anything that renders into an outgoing message

    Products and areas

  • File and image upload, storage and the routes that serve uploaded content back

    Products and areas

  • Import and export routines, which parse an operator-supplied archive and write directly into the content store

    Products and areas

  • Integrations, webhooks and the API key model behind them

    Products and areas

  • Staff accounts, the role model above them, and the invitation flow that creates new ones

    Products and areas

  • The Admin API in full, along with the session and token handling that gates it

    Products and areas

  • The Content API and the keys that decide which posts an anonymous request can read, including drafts and member-only content

    Products and areas

  • The members system end to end: signup, sign-in tokens, the member session, and every member-facing endpoint on a public site

    Products and areas

  • The published policy asks for any vulnerability in Ghost through the security address or a GitHub advisory, and names exactly one carve-out. Beyond that it draws no boundary around the codebase

    Products and areas

  • The setup, update and migration paths, which run with more authority than the running site

    Products and areas

  • Theme handling and the template rendering layer, including theme upload, validation and activation

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Deployment configuration: reverse-proxy setup, mail credentials and storage adapters the operator chose

  • Findings that need an administrator account already in hand, since a full administrator sits inside the trust boundary by design

  • Privilege escalation as a result of trusted users publishing arbitrary JavaScript, the one exclusion the policy names outright

  • Reports filed on hackerone.com/ghost, which is an unrelated researcher's profile rather than a Ghost program

  • Third-party themes and integrations that are not part of the Ghost repository

  • Upstream Node and library defects, unless Ghost's own use of them is what makes the issue reachable

Recent changes

Reward and scope changes across every Ghost program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Ghost products, from the NVD.

Search NVD
  • CVE-2026-29784 High

    Ghost is a Node.js content management system. From version 5.101.6 to 6.19.2, incomplete CSRF protections around /session/verify made it possible to use OTCs in login sessions different from the requesting session. In some scenarios this might have made it easier for phishers to take over a Ghost site. This issue has been patched in version 6.19.3.

  • CVE-2026-29053 High

    Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1.

  • CVE-2026-26980 Critical

    Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

  • CVE-2026-24778 High

    Ghost is an open source content management system. In Ghost versions 5.43.0 through 5.12.04 and 6.0.0 through 6.14.0, an attacker was able to craft a malicious link that, when accessed by an authenticated staff user or member, would execute JavaScript with the victim's permissions, potentially leading to account takeover. Ghost Portal versions 2.29.1 through 2.51.4 and 2.52.0 through 2.57.0 were v

  • CVE-2026-22595 High

    Ghost is a Node.js content management system. In versions 5.121.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's handling of Staff Token authentication allowed certain endpoints to be accessed that were only intended to be accessible via Staff Session authentication. External systems that have been authenticated via Staff Tokens for Admin/Owner-role users would have had acces

  • CVE-2026-22596 Medium

    Ghost is a Node.js content management system. In versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's /ghost/api/admin/members/events endpoint allows users with authentication credentials for the Admin API to execute arbitrary SQL. This issue has been patched in versions 5.130.6 and 6.11.0.

  • CVE-2026-22597 Medium

    Ghost is a Node.js content management system. In versions 5.38.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost’s media inliner mechanism allows staff users in possession of a valid authentication token for the Ghost Admin API to exfiltrate data from internal systems via SSRF. This issue has been patched in versions 5.130.6 and 6.11.0.

  • CVE-2026-22594 High

    Ghost is a Node.js content management system. In versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's 2FA mechanism allows staff users to skip email 2FA. This issue has been patched in versions 5.130.6 and 6.11.0.

About this page

This page gathers every public program listed under ghost.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.