What is the CVSS score of CVE-2026-53943?

CVE-2026-53943 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Ghost are affected by CVE-2026-53943?

A critical vulnerability in Ghost CMS (CVSS 9.6) could allow attackers to compromise staff accounts without authentication if your organization operates the admin panel and public website on the same…. A patch is available.

How to fix or mitigate CVE-2026-53943?

Within 24 hours: Audit all Ghost deployments to identify whether admin and public frontend share a domain. Within 7 days: For co-hosted deployments, implement WAF rules blocking x-ghost-preview headers and apply strict cache policies to authenticated endpoints; alternatively, migrate admin to separate domain. Within 30 days: Subscribe to Ghost security advisories and plan immediate upgrade to patched version once released by vendor.

Ghost CVE-2026-53943

EUVD-2026-39027 CRITICAL

Use of Cache Containing Sensitive Information (CWE-524)

2026-06-24 GitHub_M

GHSA-62q6-4hv4-vjrw

Node.js Information Disclosure Ghost

9.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.2 HIGH

Network and unauthenticated (AV:N/PR:N) but gated by shared-cache and same-domain prerequisites plus victim cache retrieval (AC:H, UI:R); cache poisoning crosses trust boundary (S:C) enabling account takeover (C:H/I:H), with limited availability impact (A:L).

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 24, 2026 - 20:03 EUVD

Analysis Generated

Jun 24, 2026 - 19:17 vuln.today

DescriptionCVE.org

Ghost is a Node.js content management system. From until 6.37.0, when Ghost is behind a shared caching layer that results in cached content being shared between different visitors, an unauthenticated user could send an x-ghost-preview header that altered the rendered frontend response. In affected cache configurations, that response could be stored and served to subsequent visitors requesting the same page, allowing cache poisoning of request-specific preview output. When running Ghost's frontend and admin panel on the same domain this could be used to take over staff user accounts. When running these on different domains staff accounts have no exposure. This vulnerability is fixed in 6.37.0.

Articles & Coverage 1

News Critical Web Cache Poisoning in Ghost Node.js CMS before 6.37.0 - CVE-2026-53943 Jun 24, 2026

AnalysisAI

Web cache poisoning in the Ghost Node.js CMS before 6.37.0 lets an unauthenticated attacker inject an x-ghost-preview header that alters the rendered frontend response, which a shared caching layer then stores and serves to other visitors of the same page. When Ghost's public frontend and admin panel share a single domain, this request-specific preview output can be weaponized to hijack staff accounts; separate-domain deployments are not exposed. No public exploit is identified at time of analysis, and the issue carries a vendor CVSS of 9.6.

Technical ContextAI

Ghost is a widely used open-source headless/traditional CMS built on Node.js, commonly fronted by a CDN or reverse-proxy cache (Varnish, Cloudflare, Fastly, nginx microcaching) to absorb anonymous traffic. The vulnerability is rooted in CWE-524 (information exposure through caching): Ghost honors the request-specific x-ghost-preview header when rendering the frontend, but the resulting response is not properly distinguished (no Vary handling/cache-key separation) from a normal page. A shared cache therefore treats attacker-influenced, preview-altered output as a cacheable representation of the canonical URL and replays it to unrelated visitors. The CPE cpe:2.3:a:tryghost:ghost:*:*:*:*:*:*:*:* indicates all Ghost versions up to the 6.37.0 fix are affected.

RemediationAI

Upgrade to Ghost 6.37.0, which fixes the issue (Vendor-released patch: 6.37.0); this is the primary and recommended remediation per advisory GHSA-62q6-4hv4-vjrw (https://github.com/TryGhost/Ghost/security/advisories/GHSA-62q6-4hv4-vjrw). If you cannot patch immediately, apply compensating controls at the caching layer and topology: strip or block the x-ghost-preview header on inbound requests at the CDN/reverse proxy so it can never reach Ghost from untrusted clients (trade-off: legitimate preview workflows routed through that path break); add x-ghost-preview to the cache key or Vary handling, or exclude preview-influenced responses from the shared cache entirely (trade-off: reduced cache hit ratio); and where feasible serve the admin panel on a separate domain/subdomain from the public frontend, which removes the staff-account-takeover exposure even if cache poisoning of preview output remains possible.