Ghost CMS CVE-2026-53949

No authentication is required; the attack targets public API endpoints accessible to any network client. The vulnerability affects all Ghost deployments in the version range regardless of content configuration or access mode. The primary limiting factor is the database backend: SQLite deployments are fully exploitable (hashes recoverable), while MySQL deployments yield case-normalized hashes that the vendor assesses as practically uncrackable in further attacks. The attack is brute-force in nature, requiring a large number of API requests to enumerate private field values, which creates a detection opportunity via request volume anomalies. No specific Ghost feature needs to be enabled beyond the default public API, which is on by default in all standard deployments.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3) scores this as a Medium, and that framing is broadly consistent with real-world risk - with one important caveat. The C:L rating understates the concrete credential risk on SQLite deployments: a successfully recovered Bcrypt or similar password hash gives an attacker a direct path to account takeover via offline cracking, which is meaningfully more dangerous than generic 'low' information exposure. Conversely, MySQL deployments face substantially lower practical risk because the case-degraded hashes are unlikely to be crackable. No EPSS score was provided in the available intelligence, and the vulnerability has not been listed in CISA KEV, suggesting no confirmed active exploitation campaigns at this time. The brute-force nature of the attack - requiring many requests to enumerate private fields - introduces some detection opportunity and minor practical friction, though no authentication barrier exists. Net assessment: deployments on SQLite should treat this as a higher-priority credential-exposure risk than the 5.3 score implies; MySQL deployments face materially lower practical risk and can prioritize accordingly.

An unauthenticated attacker sends a high volume of crafted HTTP requests to Ghost's public API, each embedding filter expressions that reference private model fields (such as password hash columns) with specific value predicates. By observing whether the API returns results or not, the attacker enumerates field contents character by character or range by range - a classic filter oracle attack. On a SQLite-backed Ghost instance, this process eventually yields a recoverable password hash that can be submitted to an offline cracking tool.