CVE-2026-103284: Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-01 · updated 2026-10-01
Weakness: CWE-863

Description

Ghost versions from 5.125.1 before 6.57.1 contain an information disclosure vulnerability in the Admin Feedback endpoint that allows unauthorized staff users to access member data. Attackers with staff privileges can query the feedback endpoint to retrieve sensitive member information without proper authorization checks.

Affected products

TryGhost Ghost: from 5.125.1 before 6.57.1 — fixed in 6.57.1

How to fix

Upgrade to a fixed version: TryGhost Ghost 6.57.1. Check the vendor advisory for mitigations.

References

https://github.com/TryGhost/Ghost/security/advisories/GHSA-vm82-r49m-224q
https://www.vulncheck.com/advisories/ghost-5.125.1-before-6.57.1-information-disclosure-via-feedback

Get alerted when CVE-2026-103284 or the next vulnerability affects your stack