Junglewise Threat Intelligence

CVE-2026-53947: TryGhost Ghost information disclosure in members signin endpoint

CVE-2026-53947 · Severity: medium · CVSS 5.3 · Published 2026-06-24

Technologies: ghost (npm). Vendors: npm.

Executive brief

A vulnerability in the Ghost content management system allowed unauthorized individuals to verify if specific email addresses were registered as members of a site. By observing differences in how the sign-in system responded to various requests, an attacker could harvest lists of active members. This could lead to privacy concerns for site members and targeted phishing or social engineering attacks against them.

Technical details

Ghost is affected by an observable response discrepancy (CWE-204) within its members sign-in endpoints. Prior to the fix, the API returned different responses or error messages depending on whether a submitted email address was associated with an existing member account. An unauthenticated remote attacker could exploit this behavior to perform member enumeration by submitting a list of email addresses and analyzing the server's response. The vulnerability was addressed by normalizing the sign-in response to return a consistent 201 status code and generic messaging regardless of whether the member exists. The fix is available in Ghost version 6.21.1.

Affected products

  • TryGhost Ghost >= 5.18.0, < 6.21.1

Timeline

  • 2026-03-10: patched: Fix merged into main branch via PR #26752.
  • 2026-06-10: disclosed: Initial advisory publication.
  • 2026-06-24: advisory: NVD published CVE-2026-53947.
  • 2026-08-04: advisory: GitHub Advisory Database entry updated.

References

Related threats