CVE-2026-103272
Received Received - Intake

Staff Enumeration in Ghost CMS Content API

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: VulnCheck

Description
Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-103272
EUVD
EUVD-2026-90665

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ghost ghost From 2.10.0 (inc) to 6.63.0 (exc)
tryghost ghost From 2.10.0 (inc) to 6.63.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-203 The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Ghost versions from 2.10.0 before 6.63.0. It allows unauthenticated attackers to enumerate staff members and leak sensitive user data by observing discrepancies in API metadata responses. The flaw is classified under CWE-203 (Observable Discrepancy).

Detection Guidance

To detect this vulnerability, monitor Ghost API responses for discrepancies in metadata that reveal staff user information. Check Ghost version against 6.63.0 or higher. Use commands like curl to query the Content API endpoint and compare response patterns between staff and non-staff users.

Impact Analysis

Attackers can extract sensitive information about staff members without authentication. This includes user data exposure, which may lead to privacy breaches or unauthorized access to internal systems. The attack requires no privileges or user interaction and can be executed remotely.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized exposure of sensitive user data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A breach may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately update Ghost to version 6.63.0 or later. For Docker installations, pull the latest image and redeploy. For Ghost-CLI, run 'ghost update'. Verify the update by checking the version and testing API responses for consistent metadata.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103272. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart