CVE-2026-103280 in Ghost
Summary
by MITRE • 10/01/2026
Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote visitor to obtain it.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The Ghost content management system, specifically versions ranging from 0.8.0 up to but not including version 6.23.0, contains a significant information disclosure vulnerability within its administrative setup endpoint. This flaw allows unauthenticated users to retrieve sensitive configuration data that should be restricted during the initial installation or reconfiguration process. The vulnerability stems from improper access control mechanisms on an API route intended for internal system operations rather than public consumption. When a remote actor sends a request to this specific endpoint without providing valid authentication credentials, the server processes the query and returns a response containing the email address associated with the site owner account. This behavior persists because the application fails to verify that the requester has appropriate privileges before exposing administrative details.
From a technical perspective, this issue represents a classic case of broken access control where sensitive information is exposed through an API endpoint that lacks proper authentication checks. The setup endpoint is designed to handle configuration data during the initial bootstrapping phase or when administrators are updating site settings. However, in these affected versions, the security boundary protecting this route is insufficiently enforced against unauthenticated requests. Consequently, any individual with network connectivity to the Ghost instance can query this endpoint and receive a structured response containing the owner's email address. This information serves as a valuable reconnaissance artifact for attackers seeking to identify potential targets or prepare for further attacks such as credential stuffing, phishing campaigns, or social engineering efforts aimed at compromising administrative accounts.
The operational impact of this vulnerability is primarily centered around intelligence gathering by malicious actors. While the disclosure of an email address alone does not directly compromise system integrity or availability, it significantly lowers the barrier for subsequent attack vectors. Attackers can use the exposed email to craft targeted phishing emails that appear legitimate and originate from known administrative addresses, thereby increasing the likelihood of user deception. Furthermore, this information aids in mapping out the organizational structure associated with a specific Ghost instance, which can be correlated with other data leaks or breaches to build comprehensive profiles of target entities. In environments where multiple sites are hosted on a single server, discovering owner emails across different instances could facilitate lateral movement or coordinated attacks against related services.
This vulnerability aligns closely with CWE-200, which defines Information Exposure as the intentional or unintentional disclosure of information to an actor that is not explicitly authorized to have access to that information. Additionally, it maps to MITRE ATT&CK technique T1592, specifically Gather Victim Host Information, where adversaries collect details about a target's infrastructure and personnel to plan further exploitation activities. The exposure occurs during the reconnaissance phase of the cyber kill chain, providing attackers with critical data points before attempting more invasive exploits such as brute force attacks against login pages or exploiting other potential weaknesses in the application logic.
To mitigate this risk, administrators should immediately upgrade their Ghost instances to version 6.23.0 or later, where this access control flaw has been addressed by enforcing strict authentication requirements on all administrative endpoints. For organizations unable to patch immediately due to compatibility constraints, implementing a web application firewall rule that blocks unauthenticated requests to the setup endpoint can provide temporary protection. It is also advisable to review server logs for any signs of automated scanning or repeated requests to this specific route, which may indicate active reconnaissance by malicious actors. Regular security audits and penetration testing should be conducted to ensure that no other endpoints suffer from similar misconfigurations regarding authentication and authorization checks.