EUVD-2026-39022
GHSA-chgm-3698-jm42
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network access confirmed by description; discrepancy leaks only membership existence, so C:L with no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Ghost is a Node.js content management system. From 5.18.0 until 6.21.1, a discrepancy in responses from the members signin endpoints made it possible for an unauthenticated attacker to determine whether a given email address belongs to a registered member of a Ghost site. This vulnerability is fixed in 6.21.1.
AnalysisAI
Ghost CMS versions 5.18.0 through 6.21.1 expose registered member email addresses to unauthenticated enumeration via observable discrepancies in the members signin endpoint responses. Any Ghost site with the members feature active is affected, allowing an attacker to silently probe whether arbitrary email addresses belong to site subscribers. No public exploit or active exploitation (CISA KEV) has been identified; vendor patch is available in 6.21.1.
Technical ContextAI
Ghost is a Node.js open-source CMS (CPE: cpe:2.3:a:tryghost:ghost) with a built-in membership and subscription system. The root cause is CWE-204 (Observable Response Discrepancy): the members signin endpoints return detectably different responses - whether via HTTP status codes, response body content, timing, or error messaging - depending on whether the submitted email address matches a registered member record. This class of flaw is common in authentication flows where server-side logic branches differently for known vs. unknown users without normalizing the outward response. The discrepancy effectively turns the signin endpoint into a membership oracle.
RemediationAI
Upgrade Ghost to version 6.21.1 or later, which resolves the response discrepancy in the members signin endpoints. This is the only confirmed fix per the vendor advisory at https://github.com/TryGhost/Ghost/security/advisories/GHSA-chgm-3698-jm42. If an immediate upgrade is not feasible, a compensating control is to implement aggressive rate limiting on the members signin endpoints at the reverse proxy or WAF layer to slow automated enumeration; note this may impact legitimate login attempts and does not eliminate the underlying discrepancy. Alternatively, temporarily disabling public member signup - if the site's functionality permits - removes the attack surface entirely until patching is possible, at the cost of blocking new member registrations.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
Same weakness CWE-204 – Observable Response Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today