CVE-2026-103284 is an incorrect authorization vulnerability in TryGhost's Ghost platform affecting versions >=5.125.1 and <6.57.1. The issue resides in the Admin Feedback endpoint, where staff users can query feedback data and retrieve sensitive member information without sufficient authorization validation. This allows unauthorized access to member data by users who have staff-level privileges but should not have access to such information.

Attackers with staff privileges can exploit this vulnerability to access sensitive member data that should be restricted. This could lead to information disclosure and potential privacy violations. There is no indication of privilege escalation or remote code execution. The impact is limited to unauthorized data exposure within the application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor the TryGhost vendor advisories for updates. Until a fix is available, restrict staff user permissions to the minimum necessary and avoid granting unnecessary access to the Admin Feedback endpoint.