CVE-2026-103272 in Ghost
Summary
by MITRE • 10/01/2026
Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without authentication.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The Ghost platform, specifically versions ranging from 2.10.0 up to but not including 6.63.0, contains a critical information disclosure vulnerability within its content application programming interface. This flaw stems from an improper restriction of access control mechanisms that allows unauthenticated actors to perform user enumeration attacks. The core technical issue lies in the way the API handles metadata responses for staff members and other internal entities. When an attacker queries these endpoints without valid authentication credentials, the system does not uniformly suppress information about non-existent or restricted users. Instead, it returns varying response structures or status codes that differ based on whether a specific user ID corresponds to an existing staff member versus a non-staff entity or a nonexistent record. This discrepancy in API behavior serves as a side-channel vector for enumeration.
By systematically iterating through potential user identifiers and analyzing the subtle differences in the returned metadata, such as response time variations, JSON structure changes, or distinct error messages, attackers can accurately determine which IDs correspond to active staff accounts. Once valid staff usernames are identified, these actors can leverage this knowledge to launch targeted credential stuffing attacks or brute-force attempts against specific high-privilege accounts. The ability to enumerate users without authentication significantly lowers the barrier for entry in attack scenarios where password policies might otherwise be strong enough to prevent direct guessing but insufficient against automated enumeration followed by targeted cracking. This vulnerability effectively bypasses the intended security boundary of the content API, which is designed to expose only public-facing data while keeping administrative and staff details private.
The operational impact of this vulnerability extends beyond simple user discovery. The exposure of staff usernames facilitates social engineering attacks where attackers can craft highly personalized phishing emails that appear legitimate because they reference real internal personnel or roles. Furthermore, the enumeration capability aids in reconnaissance phases for more advanced persistent threats seeking to map out an organization's digital infrastructure and identify high-value targets within the Ghost instance. This aligns with common attack patterns described in industry frameworks such as CWE-203, which classifies this type of information exposure through observable discrepancies, and CWE-640, which addresses weak password recovery mechanisms that may be exploited once usernames are known. Additionally, from a tactical perspective, this behavior mirrors techniques found in the MITRE ATT&CK framework under Initial Access tactics, specifically those involving account enumeration to facilitate subsequent compromise activities.
Mitigation strategies for this vulnerability primarily involve upgrading the Ghost installation to version 6.63.0 or later, where these access control checks have been hardened to ensure uniform responses regardless of user existence or role. For organizations unable to upgrade immediately due to compatibility constraints, implementing a web application firewall rule set can help detect and block automated enumeration patterns by rate-limiting requests that exhibit the specific metadata discrepancy signatures associated with this flaw. Additionally, administrators should enforce strict password policies for all staff accounts to mitigate the risk of credential compromise following successful enumeration. Regular security audits focusing on API response consistency are also recommended to identify similar information leakage vectors in other endpoints within the application ecosystem.