Ghost CMS EUVD-2026-90663

Requires an authenticated Ghost site-member account (any registered member, including free tier) on a site at version 5.3.0 up to but not including 6.62.0 that publishes gated/premium (paywalled) content. The attacker must be a logged-in member but one WITHOUT access rights to the targeted gated posts. Exploitation is limited to reading post excerpts (preview snippets) only - not full gated article bodies - so impact is bounded to partial content disclosure; sites with no gated/members-only content are unaffected.

This is a low-to-moderate real-world risk despite the input's 6.9 CVSS 4.0 score. The vendor 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L...) rates confidentiality impact as Low and all other impacts None, which correctly caps severity - but the vector's PR:N (unauthenticated) directly CONTRADICTS the description, which explicitly states 'an authenticated site member' performs the attack. This is a meaningful discrepancy: exploitation requires a valid Ghost member account, so real privilege is PR:L, not PR:N - verify with vendor. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so this is not confirmed actively exploited. The actual leaked data is merely post excerpts (partial previews) of gated/paywalled content - not full articles, credentials, or member PII - so the practical impact is bounded to information disclosure of teaser text. This is a genuine but minor authorization-boundary bug, not a priority emergency; it rates well below high-CVSS flaws with real exploitation signals.

An attacker registers or already holds a free (non-paying) Ghost site membership, then queries the content/members API or browses post listings and receives the excerpt fields of premium gated posts they have not paid for or been granted access to. No public exploit code exists; the attack is simple API enumeration requiring only a logged-in member session, yielding teaser text of otherwise-restricted content.