CVE-2023-31133: Ghost vulnerable to disclosure of private API fields

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 45.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-05-08 · updated 2026-06-17
Weakness: CWE-200

Description

Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members. Prior to version 5.46.1, due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute force attack. Ghost(Pro) has already been patched. Maintainers can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added. Self-hosters are impacted if running Ghost a version below v5.46.1. v5.46.1 contains a fix for this issue. As a workaround, add a block for requests to `/ghost/api/content/*` where the `filter` query parameter contains `password` or `email`.

Affected products

TryGhost Ghost: before 5.46.1 — fixed in 5.46.1

How to fix

Upgrade to a fixed version: TryGhost Ghost 5.46.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-31133 or the next vulnerability affects your stack