CVE-2026-53949: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in TryGhost Ghost
### Impact The validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully accessible. If MySQL was used as the database the password hashes' case (uppercase / lowercase) would have been lost, which would likely have rendered a further brute force attack on the discovered hashes fruitless. ### Vulnerable versions This vulnerability is present in Ghost from v5.46.1 up to v6.21.1. ### Patches v6.21.2 contains a fix for this issue. ### How to update For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost). If your Ghost is a Ghost-CLI install see our documentation on [updating it to the latest version here](https://docs.ghost.org/update). ### Workarounds If upgrading immediately is not possible, block or filter requests to Content API endpoints where the `filter` query parameter contains `password` or `email` (including any compound form such as `users.password`, `users.email`, `authors.password`, `authors.email`). Reject requests at a reverse proxy / WAF layer before they reach Ghost. Example (case-insensitive) pattern to block on the raw querystring: ``` filter=[^&]*(password|email) ``` ### References Ghost thanks crnkovic for disclosing this vulnerability responsibly. ### For more information If you have any questions or comments about this advisory, email Ghost at [[email protected]](mailto:[email protected]).
AI Analysis
Technical Summary
CVE-2026-53949 is a sensitive information exposure vulnerability in TryGhost Ghost where validation on filters in public API endpoints can be partially bypassed. This flaw enables an attacker to reveal private fields through brute force attacks on the filter parameter. When SQLite is the backend database, password hashes are fully exposed; with MySQL, case normalization of hashes likely diminishes brute force attack success. The vulnerability affects Ghost versions from 5.46.1 up to but not including 6.21.2, which contains the official patch.
Potential Impact
An attacker can exploit this vulnerability to access private fields, including password hashes, via the public API. Full password hash exposure occurs with SQLite databases, increasing risk of credential compromise. With MySQL, the altered case of hashes reduces the likelihood of successful brute force attacks. No integrity or availability impacts are reported. There is no evidence of known exploits in the wild at this time.
Mitigation Recommendations
An official patch is available in Ghost version 6.21.2 and should be applied promptly. For environments where immediate upgrading is not feasible, it is recommended to block or filter requests to Content API endpoints containing filter query parameters with 'password' or 'email' substrings (case-insensitive) at the reverse proxy or WAF level. This prevents unauthorized access to sensitive fields until the patch can be deployed.
CVE-2026-53949: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in TryGhost Ghost
Description
### Impact The validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully accessible. If MySQL was used as the database the password hashes' case (uppercase / lowercase) would have been lost, which would likely have rendered a further brute force attack on the discovered hashes fruitless. ### Vulnerable versions This vulnerability is present in Ghost from v5.46.1 up to v6.21.1. ### Patches v6.21.2 contains a fix for this issue. ### How to update For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost). If your Ghost is a Ghost-CLI install see our documentation on [updating it to the latest version here](https://docs.ghost.org/update). ### Workarounds If upgrading immediately is not possible, block or filter requests to Content API endpoints where the `filter` query parameter contains `password` or `email` (including any compound form such as `users.password`, `users.email`, `authors.password`, `authors.email`). Reject requests at a reverse proxy / WAF layer before they reach Ghost. Example (case-insensitive) pattern to block on the raw querystring: ``` filter=[^&]*(password|email) ``` ### References Ghost thanks crnkovic for disclosing this vulnerability responsibly. ### For more information If you have any questions or comments about this advisory, email Ghost at [[email protected]](mailto:[email protected]).
CVSS v3.1
Score 5.3medium
Affected software
TryGhost
Ghost
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-53949 is a sensitive information exposure vulnerability in TryGhost Ghost where validation on filters in public API endpoints can be partially bypassed. This flaw enables an attacker to reveal private fields through brute force attacks on the filter parameter. When SQLite is the backend database, password hashes are fully exposed; with MySQL, case normalization of hashes likely diminishes brute force attack success. The vulnerability affects Ghost versions from 5.46.1 up to but not including 6.21.2, which contains the official patch.
Potential Impact
An attacker can exploit this vulnerability to access private fields, including password hashes, via the public API. Full password hash exposure occurs with SQLite databases, increasing risk of credential compromise. With MySQL, the altered case of hashes reduces the likelihood of successful brute force attacks. No integrity or availability impacts are reported. There is no evidence of known exploits in the wild at this time.
Mitigation Recommendations
An official patch is available in Ghost version 6.21.2 and should be applied promptly. For environments where immediate upgrading is not feasible, it is recommended to block or filter requests to Content API endpoints containing filter query parameters with 'password' or 'email' substrings (case-insensitive) at the reverse proxy or WAF level. This prevents unauthorized access to sensitive fields until the patch can be deployed.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-11T15:50:01.281Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a3c2387748d17fc4ff2f772
Added to database: 06/24/2026, 18:35:51 UTC
Last enriched: 08/05/2026, 15:32:35 UTC
Last updated: 09/21/2026, 10:01:33 UTC
Views: 81
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.