CVE-2026-103272 Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without...

CVE-2026-103273 Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token

Ghost versions 4.3.0 before 6.58.0 contain an authentication bypass vulnerability where lower-privilege staff users can use staff tokens to bypass post editing restrictions. Attackers with staff credentials can leverage tokens to edit posts beyond their assigned privilege level...

CVE-2026-103273

Ghost versions 4.3.0 before 6.58.0 are affected by an authentication bypass vulnerability. The root cause is incorrect authorization via staff tokens, which allows lower-privilege staff users to bypass post editing restrictions. Specifically, attackers possessing staff credentials can leverage th...

EUVD-2026-90666

Ghost versions 4.3.0 before 6.58.0 contain an authentication bypass vulnerability where lower-privilege staff users can use staff tokens to bypass post editing restrictions. Attackers with staff credentials can leverage tokens to edit posts beyond their assigned privilege level...

CVE-2026-103272 Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without...

EUVD-2026-90665

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without...

CVE-2026-103272

Ghost versions from 2.10.0 before 6.63.0 are affected by a staff enumeration vulnerability within the content API . This flaw allows unauthenticated attackers to leak sensitive user data by observing discrepancies in API metadata responses . While the vulnerability allows for the enumeration of s...

CVE-2026-103272 Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without...

CVE-2026-103271 Ghost 4.0.0 before 6.63.0 Restricted Content Bypass

Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts without authentication...

CVE-2026-103271

Ghost versions from 4.0.0 before 6.63.0 are vulnerable to a content API vulnerability that enables unauthenticated visitors to bypass content restrictions. Attackers can directly query the content API to retrieve gated post content without providing any authentication. No specific exploit details...

CVE-2026-103271 Ghost 4.0.0 before 6.63.0 Restricted Content Bypass

Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts without authentication...

CVE-2026-103271 Ghost 4.0.0 before 6.63.0 Restricted Content Bypass

Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts without authentication...

CVE-2026-103269

Ghost versions 5.3.0 before 6.62.0 are impacted by a missing authorization vulnerability. This flaw allows an authenticated site member to access and read excerpts of posts that are otherwise restricted as gated content . No specific exploit information or remediation steps are provided in the do...

EUVD-2026-90663

Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of posts they do not have access to gated content...

CVE-2026-103269 Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts

Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of posts they do not have access to gated content...

CVE-2026-103269 Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts

Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of posts they do not have access to gated content...

CVE-2026-103268 Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset

Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through self-service password reset. Attackers with suspended staff credentials can perform password reset operations to regain active account access and...

CVE-2026-103268 Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset

Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through self-service password reset. Attackers with suspended staff credentials can perform password reset operations to regain active account access and...

EUVD-2026-90662

Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through self-service password reset. Attackers with suspended staff credentials can perform password reset operations to regain active account access and...

CVE-2026-103268

Ghost versions before 6.62.0 are vulnerable to an authentication bypass flaw. This vulnerability allows users with suspended staff credentials to reactivate their accounts and restore original privileges by performing a self-service password reset . No specific exploit links or in-the-wild exploi...