EUVD-2026-90673
GHSA-hj3g-fppx-9pv5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Ghost-hosted site
-
ExploitSend unauthenticated request to setup endpoint
-
ExecutionReceive owner email in response
-
ImpactUse address for targeted phishing/recon
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Outbound data filtering
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Ghost (versions 0.8.0 through before 6.23.0). The setup endpoint responds to unauthenticated requests with the site owner's email address, requiring no account, no user interaction, and no non-default setting. The only inherent limit is the narrow impact: exploitation yields solely the owner's email address (no credentials, content, or system access), capping realistic damage at reconnaissance and phishing enablement. |
| Impact | This is a low-impact information disclosure flaw whose CVSS 4.0 base score of 6.9 overstates the real-world priority. The vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) correctly captures an unauthenticated, network-reachable, no-interaction leak, but the only consequence is disclosure of the site owner's email address - a single low-sensitivity datum with no integrity or availability impact (VI:N/VA:N) and no scope change (SC:N). No EPSS score, CISA KEV listing, or public proof-of-concept is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The score inflation is an artifact of CVSS 4.0 weighting an unauthenticated network leak heavily even when the leaked asset is trivial; a CVSS 3.1 reading lands around 5.3 (C:L only). Practical risk is confined to reconnaissance/phishing enablement rather than direct compromise. The signals are internally consistent - no conflicts between the vector and the description - so the main caveat is simply that the numeric severity should not drive emergency patching. |
| Exploit ScenarioDerived | A remote attacker, without any account or authentication, sends a request to the Ghost setup endpoint of a target blog and receives the site owner's email address in the response. The harvested address is then used to seed targeted phishing, credential-stuffing, or account-recovery social-engineering against the owner. No public proof-of-concept is referenced, and no privileges or user interaction are required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
The setup endpoint in Ghost CMS returns the site owner's email address to any remote, unauthenticated visitor, exposing every release from 0.8.0 up to but not including 6.23.0. Exploitation requires no account, no user interaction, and no non-default configuration, but the yield is limited to a single email address - no credentials, content, or system access - so realistic impact is reconnaissance and phishing enablement rather than direct compromise. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and vendor patching is available in 6.23.0.
RemediationAI
Vendor-released patch: upgrade Ghost to 6.23.0 or later, which is the first fixed release; remediation guidance and version details are in the GitHub advisory GHSA-5685-hwm9-62cg and the VulnCheck advisory. If upgrading immediately is not possible, block external reachability of the setup/onboarding endpoint at the reverse proxy, WAF, or load balancer and allow it only from trusted administrative networks - the trade-off is that this also prevents legitimate fresh-install bootstrap from untrusted locations and must be removed once patched. Because the disclosed datum is only the owner's email address, consider the exposure primarily a phishing and reconnaissance risk: rotate or de-prioritize any address used as an administrative contact if it was publicly exposed, and monitor for credential-phishing campaigns aimed at that address. No vendor workaround beyond the upgrade is documented in the supplied references.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data): the setup/onboarding API surfaced by Ghost's admin backend includes the site owner's email address in its HTTP response without verifying that the requester is authorized to see it. Because Ghost, a Node.js-based publishing platform, must expose setup routes before an administrator account is fully configured, those routes are reachable pre-authentication by design, and the defect lies in response filtering/authorization rather than in transport security or cryptography. The CPE cpe:2.3:a:tryghost:ghost:*:*:*:*:*:*:*:* confirms the affected package is the upstream tryghost:ghost codebase across the entire 0.8.0-to-6.23.0 span, meaning self-hosted instances and any deployment shipping the same code path are equally exposed; EUVD-2026-90673 and the VulnCheck advisory cover the same range. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:L with no integrity or availability impact) matches the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N): remote, unauthenticated, low-confidentiality disclosure only.
Know when Ghost gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Unauthenticated network request with no interaction (AV:N/AC:L/PR:N/UI:N) leaks only a low-sensitivity email address, so C:L with no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote visitor to obtain it.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Ghost CMS versions 5.105.0-5.130.5 and 6.0.0-6.10.3 contain an authentication bypass in their two-factor authentication
Arbitrary code execution in Ghost CMS versions 0.7.2 through 6.19.0 allows authenticated attackers with theme upload pri
An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitr
An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary
SQL injection in Ghost CMS versions 3.24.0 through 6.19.0 allows unauthenticated attackers to read arbitrary database da
Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any acco
Ghost before 5.82.0 allows CSV Injection during a member CSV export. Rated high severity (CVSS 8.8), this vulnerability
Server-side request forgery (SSRF) vulnerability in Ghost CMS < 3.10.0 allows an attacker to scan local or external netw
Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2
Ghost is a Node.js CMS. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, no authentication
Ghost is an open source content management system. Rated medium severity (CVSS 6.5), this vulnerability is remotely expl
Exploit-DB