Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: TryGhost Ghost 6.23.0 Clear all filters
TI-2026-65657 CVE-2026-103282 · GHSA-fgrp-x4pm-v894

Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token

Priority LOW 23

Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invitation acceptance mechanism that allows multiple accounts to be created from a single invite token.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00139 Published 2026-10-01 Fixed in 6.23.0 CWE-362
TI-2026-65656 CVE-2026-103281 · GHSA-crq6-86x9-65hj

Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API

Priority LOW 23

Ghost (npm package 'ghost') versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00156 Published 2026-10-01 Fixed in 6.23.0 CWE-201
TI-2026-65655 CVE-2026-103280 · GHSA-hj3g-fppx-9pv5

Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint

Priority LOW 36

Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote vi…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00205 Published 2026-10-01 Fixed in 6.23.0 CWE-201