Threat database

Ghost versions 6.20.0 through 6.57.0 have a session handling vulnerability that allows authenticated staff users to impersonate other staff users by bypassing two-factor authentication. This flaw enables attackers with valid staff credentials to gain unauthorized administrative access.

Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invitation acceptance mechanism that allows multiple accounts to be created from a single invite token. Attackers can exploit this race condition by submitting concurrent requests with the same invitation token to create duplicate user accounts.

Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote visitor to obtain it.

Ghost versions from 3.10.0 up to but not including 6.34.0 have a vulnerability where sessions are not fully invalidated after a user changes their password. This allows an attacker with a stolen session cookie to maintain access to the user account despite the password change. The vulnerability has a high severity score of 7.6.

Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content publishing privileges can craft malicious pages that, when visited by active staff users, enable account takeover through improper input validation.

Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially compromising administrative access.

Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attackers to read theme templates and metadata. Attackers can use URL encoding to bypass extension validation and access sensitive theme files.

Ghost versions from 5.42.2 up to but not including 6.58.0 have an information disclosure vulnerability in the Admin API's bulk post and page edit and delete endpoints. These endpoints improperly allow filtering on restricted fields such as authors.password due to an incomplete fix for a previous vulnerability (CVE-2026-70590). This flaw enables staff-level attackers to infer password hashes of other staff users, which can then be subjected to offline password-guessing attacks.

Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read comments that should be restricted, bypassing privacy settings.

Ghost versions 4.3.0 before 6.58.0 contain an authentication bypass vulnerability where lower-privilege staff users can use staff tokens to bypass post editing restrictions. Attackers with staff credentials can leverage tokens to edit posts beyond their assigned privilege level.

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without authentication.

Ghost versions from 4.0.0 up to but not including 6.63.0 have a vulnerability in the content API that allows unauthenticated users to access gated post content. This flaw enables attackers to bypass content restrictions by directly querying the API without authentication.

Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of posts they do not have access to (gated content).

Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through self-service password reset. Attackers with suspended staff credentials can perform password reset operations to regain active account access and restore their original privileges.

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can register with unintended email providers.

Ghost versions 5.2.0 through prior to 6.62.0 contain an authorization vulnerability allowing unauthenticated remote attackers to abuse the Stripe Checkout flow. This flaw permits attackers to attach paid subscriptions to existing members, modify member names, and inject content into newsletters. The injected content may lead to HTML injection or cross-site scripting (XSS) depending on the recipient's email client.

Ghost, a Node.js content management system, contains a path traversal vulnerability in versions from 1.20.1 up to but not including 6.54.1. An administrator-level user could exploit this flaw by supplying a crafted database backup filename containing path separators, allowing remote overwriting of certain filesystem files. This vulnerability affects the integrity and availability of the system. The issue is fixed in version 6.54.1.

A Server-Side Request Forgery (SSRF) vulnerability exists in TryGhost Ghost versions from 0.10.0 up to but not including 6.54.1. This flaw allows any staff-level user to perform blind HTTP GET requests to internal hosts via the Ghost Admin image fetching functionality. Although no response data is returned, the vulnerability could be used to probe internal network ports. The issue is resolved in version 6.54.1.

CVE-2026-24778 is a high-severity cross-site scripting (XSS) vulnerability in the TryGhost Ghost CMS and its Portal component. It affects Ghost versions 5.43.0 through 5.12.04 and 6.0.0 through 6.14.0, as well as Portal versions 2.

Ghost is a Node.js content management system. In versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's /ghost/api/admin/members/events endpoint allows users with authentication credentials for the Admin API to execute arbitrary SQL. This issue has been patched in versions 5.130.6 and 6.11.0.