Cross-site Stripe subscription leakage between multiple Ghost instances causing shared membership and incorrect analytics

Bugs
1

When using the same Stripe account across multiple independent Ghost CMS sites, I am observing unexpected cross-site membership and subscription sharing. Users subscribed on one site appear in other sites’ member lists, and subscription data is not properly isolated per Ghost instance. This also causes incorrect MRR reporting and analytics breakdowns across sites.

Issue Summary

When connecting the same Stripe account to multiple independent Ghost CMS sites, membership and subscription data appears to be shared across sites. This causes cross-site membership leakage, incorrect subscriber associations, and inaccurate analytics (including MRR and dashboard charts).

This appears to be a boundary/isolation issue when multiple Ghost instances use a single Stripe account.

What did you expect to happen?

Each Ghost site should fully isolate its own membership and subscription data, even when using the same Stripe account.

A user who subscribes to example1.com should not appear as a member of example2.com unless they explicitly subscribe there as well.

Stripe subscriptions should remain correctly scoped per site to ensure:

  • Independent member databases/VPS per Ghost instance
  • No cross-site subscriber visibility
  • Accurate email delivery per site only
  • Correct MRR and analytics per individual site

Steps to Reproduce

  1. Set up two separate Ghost CMS sites (e.g. abc.example.com and xyz.example.com or example1.com or example2.com)
  2. Connect both sites to the same Stripe account
  3. Subscribe a user on abc.example.com
  4. Subscribe a user (or same email) on xyz.example.com
  5. Check member lists in both Ghost admin dashboards
  6. Observe that subscription/membership data overlaps or appears in both sites
  7. Trigger a paid post or member email from one site and observe unexpected cross-site exposure

Setup information

Ghost Version
6.32.0

Environment
Production

Node.js Version
v22.x

How did you install Ghost?
Ghost-CLI

Provide details of your host & operating system
Ubuntu 24.04 LTS (self-hosted VPS)

Database type
MySQL 8.0.x

Mail
SMTP

Additional notes

This issue impacts multi-site Ghost setups using a shared Stripe account:

  • Membership isolation between separate Ghost instances is not maintained
  • Cross-site email and member visibility risks
  • MRR and subscription analytics become unreliable
  • Stripe subscriptions appear not fully scoped per Ghost instance

I am able to provide Stripe webhook payloads, member exports, and screenshots upon request to assist with reproducing and investigating this issue.

2

(I don’t work for ghost.)

I can confirm that this behavior exists.

The workaround is to create one stripe account per ghost site. This is easy in Stripe. Hooking multiple services (ghost or otherwise) into Stripe is generally not something I recommend. In addition to the behavior above, stripe is also fussy about how many different api versions can fire webhooks in the same account. I’ve had clients with problems resulting from linking multiple different platforms into the same stripe — the webhooks just silently fail to fire, which means subscriptions don’t get correctly created.)