Ghost CMS EUVD-2026-90677

Requires an authenticated Ghost staff account (PR:L) on an affected instance running Ghost 5.125.1 up to but not including 6.57.1; the attacker then queries the Admin Feedback endpoint, which omits proper authorization checks. Exploitation is limited to actors who already possess valid staff credentials - it is not reachable by anonymous/unauthenticated users or by public members/subscribers, and no user interaction is needed. Impact is confined to disclosure of member data (confidentiality only); no modification or denial of service results. Realistic risk scales with how widely staff accounts are provisioned and how sensitive the member records are.

This is a genuine but moderate-severity authorization flaw, not a high-impact emergency. The vendor (VulnCheck) CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N scores 5.3 and is internally consistent with the description: network-reachable, low complexity, but requiring low privileges (PR:L = an authenticated staff account) and yielding only low confidentiality impact (VC:L) with no integrity or availability effect. The CWE-863 (improper authorization) classification matches the description's 'without proper authorization checks' far better than the 'Authentication Bypass' tag, which is misleading since a valid staff login is a prerequisite. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public-exploit signal; exploitation status is best characterized as no public exploit identified at time of analysis. The practical risk is horizontal/privilege-scoped information disclosure: a lower-tier staff member reading member data they should not see. Priority is moderate and should be driven by whether the organization grants staff accounts broadly and how sensitive its member data is, rather than by the raw CVSS number.

An attacker who already holds a low-privilege Ghost staff account (for example, an Author or Contributor on a shared publication) sends authenticated requests to the Admin Feedback endpoint, which fails to enforce authorization. The endpoint returns member data the staff user is not entitled to view, enabling harvesting of subscriber/member information. No public proof-of-concept is available, but exploitation is straightforward given a valid staff credential.