CVE-2026-53949

Ghost is a Node.js content management system. From 5.46.1 until 6.21.2, the validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully accessible. If MySQL was used as the database the password hashes' case (uppercase / lowercase) would have been lost, which would likely have rendered a further brute force attack on the discovered hashes fruitless. This vulnerability is fixed in 6.21.2.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/TryGhost/Ghost/security/advisories/GHSA-jx35-x7fj-vgpr

Configurations

No configuration.

History

25 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Ghost es un sistema de gestión de contenido Node.js. Desde 5.46.1 hasta 6.21.2, la validación aplicada a los filtros en los puntos finales de la API pública podría ser parcialmente eludida, haciendo posible revelar campos privados mediante un ataque de fuerza bruta. Si se usaba SQLite como la base de datos, los hashes de las contraseñas eran totalmente accesibles. Si se usaba MySQL como la base de datos, el caso (mayúsculas / minúsculas) de los hashes de las contraseñas se habría perdido, lo que probablemente habría hecho que un ataque de fuerza bruta adicional sobre los hashes descubiertos fuera infructuoso. Esta vulnerabilidad está corregida en 6.21.2.

Information

Published : 2026-06-24 19:17

Updated : 2026-10-25 22:10

NVD link : CVE-2026-53949

Mitre link : CVE-2026-53949

CVE.ORG link : CVE-2026-53949

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-693

Protection Mechanism Failure

{"id": "CVE-2026-53949", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53949", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-24T18:55:06.184455Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "TryGhost", "product": "Ghost", "versions": [{"status": "affected", "version": ">= 5.46.1, < 6.21.2"}]}]}], "published": "2026-06-24T19:17:12.580", "references": [{"url": "https://github.com/TryGhost/Ghost/security/advisories/GHSA-jx35-x7fj-vgpr", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "Ghost is a Node.js content management system. From 5.46.1 until 6.21.2, the validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully accessible. If MySQL was used as the database the password hashes' case (uppercase / lowercase) would have been lost, which would likely have rendered a further brute force attack on the discovered hashes fruitless. This vulnerability is fixed in 6.21.2."}, {"lang": "es", "value": "Ghost es un sistema de gesti\u00f3n de contenido Node.js. Desde 5.46.1 hasta 6.21.2, la validaci\u00f3n aplicada a los filtros en los puntos finales de la API p\u00fablica podr\u00eda ser parcialmente eludida, haciendo posible revelar campos privados mediante un ataque de fuerza bruta. Si se usaba SQLite como la base de datos, los hashes de las contrase\u00f1as eran totalmente accesibles. Si se usaba MySQL como la base de datos, el caso (may\u00fasculas / min\u00fasculas) de los hashes de las contrase\u00f1as se habr\u00eda perdido, lo que probablemente habr\u00eda hecho que un ataque de fuerza bruta adicional sobre los hashes descubiertos fuera infructuoso. Esta vulnerabilidad est\u00e1 corregida en 6.21.2."}], "lastModified": "2026-10-25T22:10:00.150", "sourceIdentifier": "security-advisories@github.com"}