Ghost Release: 5.110.3

TL;DR

Ghost v5.110.3 fixes a critical security vulnerability where the email domain blocklist was not being checked when members updated their email addresses. This patch ensures that spam prevention measures are consistently applied across all email-related operations, protecting publications from unwanted signups from blocked domains.

Highlight of the Release

• Fixed security vulnerability where email domain blocklist was bypassed during email updates
• Added consistent error messaging across multiple languages when blocked domains are detected
• Enhanced spam prevention by extending blocklist checks to all email-related operations

Migration Guide

No migration steps are required for this release. The fix is automatically applied when updating to v5.110.3.

Upgrade Recommendations

Recommended: Immediate Upgrade

This release fixes a security vulnerability that could allow users to bypass your email domain blocklist. If you use Ghost's email domain blocklist feature to prevent signups from certain domains, we strongly recommend upgrading to v5.110.3 as soon as possible to ensure complete protection against unwanted signups.

Bug Fixes

Email Domain Blocklist Enforcement

Previously, Ghost's email domain blocklist was only checked during the initial signup process, creating a security gap where members could bypass restrictions by first signing up with an allowed domain and later updating to a blocked domain. This release fixes this vulnerability by:

• Extending email domain validation to the member email update process
• Ensuring consistent application of the blocklist across all email-related operations
• Returning appropriate error messages when blocked domains are detected during email updates

This fix closes the reported issue ONC-797.

New Features

No new features were added in this release. This is a security and bug fix release focused on improving the existing email domain blocklist functionality.

Security Updates

Enhanced Email Domain Validation

This release addresses a security vulnerability where users could bypass the email domain blocklist by:

1. Initially signing up with an allowed email domain
2. Later updating their email address to a blocked domain

The fix implements consistent domain validation across all email-related operations, preventing potential spam or abuse from blocked domains. This is particularly important for publications that use the blocklist feature to prevent unwanted signups from known spam domains.

Performance Improvements

No specific performance improvements were included in this release. The focus was on security and bug fixes related to email domain validation.

Impact Summary

This release addresses a specific security vulnerability in Ghost's email domain validation system. The impact is primarily positive for site administrators who rely on email domain blocklists to prevent spam or unwanted signups. The fix ensures that these protections cannot be bypassed through the email update process.

The changes are focused on backend validation logic and error handling, with minimal user-facing changes except for the addition of clear error messages when a blocked domain is detected during email updates. These error messages have been properly localized across multiple languages.

No database schema changes, API changes, or performance impacts are included in this release. The update is straightforward with no migration steps required.

Full Release Notes