ghost is a blogging platform.
Affected versions of the package are vulnerable to Authentication Bypass. An authenticated user can spoof an
HTTP GET request with any username to access any other users’ drafts. This is due to the user parameter not being validated upon the request.
ghost to version 0.5.9 or higher.