CVE-2026-103284 in Ghost
Summary
by MITRE • 10/01/2026
Ghost versions from 5.125.1 before 6.57.1 contain an information disclosure vulnerability in the Admin Feedback endpoint that allows unauthorized staff users to access member data. Attackers with staff privileges can query the feedback endpoint to retrieve sensitive member information without proper authorization checks.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/01/2026
The identified vulnerability represents a critical failure in access control mechanisms within Ghost versions ranging from 5.125.1 up to, but not including, version 6.57.1. This flaw specifically targets the Admin Feedback endpoint, which is designed for internal administrative purposes rather than public or general staff interaction. The core technical issue lies in the absence of proper authorization checks when processing requests directed at this specific API route. While Ghost employs a role-based access control system that distinguishes between various user levels such as owner, admin, editor, author, and contributor, the implementation for the feedback endpoint fails to enforce these distinctions correctly. Consequently, any authenticated user possessing staff privileges can interact with this endpoint without encountering the necessary permission barriers intended to restrict data exposure.
From a technical perspective, this vulnerability allows unauthorized access to sensitive member information through simple HTTP requests directed at the admin feedback interface. The attacker does not need complex exploitation techniques or privilege escalation beyond having basic staff-level credentials, which are often granted more liberally than owner or full administrator rights in many Ghost deployments for operational convenience. By querying the endpoint, an adversary can retrieve detailed data about site members, potentially including email addresses, subscription statuses, and other personally identifiable information stored within the platform's database. This constitutes a classic case of broken access control where the server processes requests from users who lack the requisite authority to view or manipulate the targeted resources.
The operational impact of this vulnerability is significant due to the nature of the data exposed. Member information in content management systems like Ghost often serves as the foundation for user engagement, marketing communications, and community building. Unauthorized access to this data violates privacy expectations and can lead to severe reputational damage if leaked or misused. Furthermore, the exposure of member email addresses facilitates targeted phishing campaigns against the site's audience, thereby extending the impact beyond the immediate platform users to their contacts. This aligns with CWE-284 Improper Access Control, as the system fails to restrict access to resources based on user roles and privileges. It also maps closely to MITRE ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate credentials that have been compromised or improperly assigned to gain unauthorized entry into sensitive systems.
To mitigate this vulnerability, organizations running affected versions of Ghost must prioritize immediate patching by upgrading to version 6.57.1 or later, which contains the necessary code corrections to enforce proper authorization checks on the Admin Feedback endpoint. Until an upgrade is feasible, administrators should consider restricting access to administrative interfaces through network-level controls such as IP whitelisting if possible, although this is a less robust defense than fixing the underlying application logic. Additionally, reviewing staff user assignments and ensuring that only essential personnel have elevated privileges can reduce the attack surface by limiting the number of accounts capable of exploiting this flaw. Regular security audits and penetration testing focused on access control mechanisms are recommended to identify similar misconfigurations in other parts of the platform before they can be exploited.