Threat database

Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read comments that should be restricted, bypassing privacy settings.

Ghost versions 4.3.0 before 6.58.0 contain an authentication bypass vulnerability where lower-privilege staff users can use staff tokens to bypass post editing restrictions. Attackers with staff credentials can leverage tokens to edit posts beyond their assigned privilege level.

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without authentication.

Ghost versions from 4.0.0 up to but not including 6.63.0 have a vulnerability in the content API that allows unauthenticated users to access gated post content. This flaw enables attackers to bypass content restrictions by directly querying the API without authentication.

Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of posts they do not have access to (gated content).

Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through self-service password reset. Attackers with suspended staff credentials can perform password reset operations to regain active account access and restore their original privileges.

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can register with unintended email providers.

Ghost versions 5.2.0 through prior to 6.62.0 contain an authorization vulnerability allowing unauthenticated remote attackers to abuse the Stripe Checkout flow. This flaw permits attackers to attach paid subscriptions to existing members, modify member names, and inject content into newsletters. The injected content may lead to HTML injection or cross-site scripting (XSS) depending on the recipient's email client.

Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint. Team-scoped users can read MDM command results for hosts on other teams when a shared command UUID targets hosts across multiple teams, exposing host UUIDs, command payloads, and device responses.

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS hosts to read device data and trigger device-scoped actions including software installation and MDM migration.

Tornado versions before 6.5.9 have a vulnerability in CurlAsyncHTTPClient where highly compressed gzip responses can cause unbounded memory accumulation. This can lead to denial of service by exhausting system memory and crashing the application process.

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's Approve Within Chat mode. Attackers can submit resume requests without verification of the requester's identity or approval permissions, allowing unauthenticated users to advance waiting executions and trigger guarded actions.

n8n versions before 2.39.6 and versions from 2.40.0 up to but not including 2.40.1 have a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resolver registration capability can exploit this by setting a fallback resolver to an attacker-controlled endpoint during the account connection flow, allowing them to capture collaborators' session tokens and gain unauthorized access to credentials.

CVE-2026-103258 is a vulnerability in n8n versions before 2.39.6 and 2.40.0 before 2.40.1 affecting SendGrid, Freshservice, and ServiceNow nodes. It allows attackers to bypass query filters by injecting unescaped parameters, potentially exposing bulk data such as contact lists, tickets, and directory entries.

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized access to workflows, executions, and credential secrets within the API key's scope.

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account passwords at arbitrary hosts, bypassing domain validation controls.

n8n versions prior to 1.123.80, between 2.0.0 and 2.39.6, and between 2.40.0 and 2.40.1 have a path traversal vulnerability in the Supabase node. This flaw allows attackers to manipulate the tableId parameter without validation, potentially bypassing Row Level Security and accessing or modifying data unauthorizedly via administrative keys.

CVE-2026-103254 is a path traversal vulnerability in n8n affecting versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1. The flaw exists in the signed resume URL generation for Send-and-Wait approvals, allowing attackers with workflow creation permissions to forge approval URLs for projects they do not have access to by exploiting unresolved traversal sequences in node IDs. This enables cross-project approval forgery.

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Oracle Database node's Delete Table Drop operation. Attackers can inject single quotes in the table or schema fields to append arbitrary SQL statements and execute DDL or DML commands against the connected database with the credential's privileges.

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify an arbitrary project ID in the request body to interpolate sensitive variables into credential test requests sent to attacker-controlled hosts for exfiltration.