CVE-2026-53947 describes an information disclosure vulnerability in the Ghost CMS affecting versions >=5.18.0 and <6.21.1. The vulnerability arises from observable discrepancies in the HTTP responses of the members signin endpoints, which allow unauthenticated attackers to verify the existence of specific email addresses registered on the site. This can lead to privacy concerns and potentially facilitate targeted attacks. The vulnerability is categorized under CWE-204 (Observable Response Discrepancy). There is no explicit vendor advisory or patch link provided, but the issue is fixed in version 6.21.1.

An unauthenticated attacker can determine whether a given email address is registered on a Ghost site by analyzing differences in signin endpoint responses. This information disclosure can compromise user privacy and may aid attackers in reconnaissance or targeted phishing campaigns. There is no direct impact on integrity or availability reported.

The vulnerability is fixed in Ghost version 6.21.1. Users should upgrade to version 6.21.1 or later to remediate this issue. Patch status is not explicitly confirmed via a vendor advisory, but the description states the fix is included in 6.21.1. Until upgraded, users should be aware of the risk of email enumeration via signin endpoints.