Executive brief
Ghost, a popular content management system, has a vulnerability in its public API that could allow unauthorized individuals to access private data. By bypassing certain security filters, an attacker could potentially discover sensitive information such as user email addresses and password hashes. This could lead to account takeovers or the exposure of administrative credentials, particularly for sites using SQLite databases.
Technical details
A vulnerability in Ghost's Content API allows for the bypass of validation logic applied to the 'filter' query parameter. This flaw enables an attacker to perform brute-force attacks to reveal private fields such as 'email' and 'password' hashes. The impact varies by database backend: SQLite users are at higher risk as password hashes are fully accessible, while MySQL users may see case-insensitive hashes which are harder to crack. The vulnerability is reachable over the network without authentication. A fix is available in version 6.21.2, and a temporary workaround involves blocking 'filter' parameters containing sensitive keywords at the WAF or reverse proxy level.
Affected products
- TryGhost Ghost >= 5.46.1, < 6.21.2
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory
- 2026-06-24: other: NVD published date
- 2026-08-05: other: GitHub Advisory reviewed