WS-2019-0602

In Ghost headless CMS, versions 2.2.3 through 2.20.0 are vulnerable to improper access control, due to sensitive information returned through a low privileged HTTP request. A privileged attacker can read private, public and session keys of only-admin actions...