Ghost CMS EUVD-2026-39022

The Ghost site must have the members feature enabled and the signin endpoint publicly accessible - this is the default configuration for Ghost sites using subscriptions or newsletters. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no elevated complexity, and no user interaction are required. Limiting factors: exploitation reveals only membership status (email present/absent), not passwords, tokens, or any other data; it does not enable account takeover on its own. Ghost sites that have disabled the members feature entirely are not affected.

The CVSS 5.3 Medium score with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N accurately reflects the bounded real-world risk: the vulnerability is trivially exploitable over the network with no authentication or preconditions, but the impact is strictly limited to partial confidentiality loss - specifically, confirming whether an email is a registered member. No integrity or availability impact is present. No EPSS score was provided in the input data, and the vulnerability is not listed in CISA KEV, so exploitation probability cannot be quantified. The absence of a KEV listing and the lack of any reported POC suggest this has not been widely exploited. The primary real-world threat is privacy exposure: an attacker can compile verified subscriber email lists for targeted phishing or credential stuffing against the site's audience. For Ghost sites hosting paying members or sensitive communities, this is a meaningful but non-critical risk.

An unauthenticated attacker scripted against Ghost's members signin endpoint submits a wordlist of email addresses and inspects response differences (status code, body content, or latency) to classify each address as registered or not. The resulting verified subscriber list is then used to launch targeted phishing emails impersonating the Ghost site, improving campaign credibility and click rates compared to unverified lists. No POC has been confirmed from available data, but the technique requires only standard HTTP tooling.