Ghost EUVD-2026-90674

Requires an authenticated low-privilege Ghost staff account (PR:L) on an affected instance (versions 3.23.0 through 6.22.x) and access to the Admin API, which returns API keys that should be restricted to higher-privileged roles. No user interaction, no special non-default configuration, and no particular deployment mode beyond having staff users provisioned are needed. The primary limiting factor is the authentication requirement: an attacker must already hold valid low-privilege staff credentials, so the flaw is an insider/privilege-escalation risk rather than a remote-unauthenticated one; upgrading to 6.23.0 or later removes the exposure.

This is a genuine but modest-severity information-disclosure issue, not an urgent priority. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N, 5.3 Medium) describes a network-reachable, low-complexity flaw that nonetheless requires an authenticated low-privilege staff account (PR:L) - a meaningful gate that keeps it out of the mass-exploitation category. No EPSS score, CISA KEV listing, or public proof-of-concept is present in the supplied data, so the exploitation status is 'no public exploit identified at time of analysis.' All signals are internally consistent here: there is no conflict between a low real-world probability and the Medium CVSS, and no network-vs-local contradiction (CWE-201 exposure through the Admin API matches AV:N). The practical risk is a privilege-boundary violation - a low-privilege staff user obtains API keys meant for higher-privileged roles - which is primarily a stepping-stone/escalation concern rather than a direct compromise. Real priority is bounded: patch during normal maintenance, prioritizing instances with many low-trust staff accounts.

An attacker with (or who phishes/obtains) a low-privilege staff login to a Ghost instance authenticates to the Admin API and requests a resource whose response includes API keys intended only for Owner/Administrator roles. The attacker harvests those keys and can then use them to make Admin/Content API calls beyond their assigned staff privileges. No public exploit code is identified at time of analysis; exploitation is low-complexity but requires the authenticated staff account.