BIT-ghost-2026-103272

vendorUSosv

Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API

view advisory published 2026-10-09Licence: per source

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without authentication.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-103272US	high7.5	0.36% (30th)	—	2026-10-01
Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe…

references

External citations — patches, advisories, analysis.

https://github.com/TryGhost/Ghost/security/advisories/GHSA-ffmj-3ppp-cj4rWEB
https://nvd.nist.gov/vuln/detail/CVE-2026-103272WEB
https://www.vulncheck.com/advisories/ghost-2.10.0-before-6.63.0-staff-enumeration-via-content-apiWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan