CVE-2026-103281
Received Received - Intake

API Key Exposure in Ghost CMS via Low-Privilege Staff Access

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: VulnCheck

Description
Ghost (npm package 'ghost') versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-103281
EUVD
EUVD-2026-90674

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ghost ghost From 3.23.0 (inc) to 6.23.0 (exc)
tryghost ghost From 3.23.0 (inc) to 6.23.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-201 The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Ghost versions 3.23.0 to 6.23.0 expose API keys to low-privilege staff accounts. An authenticated low-privilege user can read API keys via the Admin API, which should only be accessible to higher-privileged users.

Impact Analysis

Low-privilege users could gain unauthorized access to sensitive API keys, potentially leading to data breaches, unauthorized actions, or misuse of API functionality.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations and penalties due to exposed API keys.

Mitigation Strategies

Upgrade Ghost to version 6.23.0 or later to address the API key exposure issue. Review staff accounts for unauthorized access and rotate exposed API keys immediately.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103281. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart