Medium severity5.3NVD Advisory· Published Oct 1, 2026

CVE-2026-103280

Description

Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote visitor to obtain it.

Affected products

Tryghost/Ghostllm-fuzzy
Range: <6.23.0

Patches

Vulnerability mechanics

References

github.com/TryGhost/Ghost/security/advisories/GHSA-5685-hwm9-62cgnvd
www.vulncheck.com/advisories/ghost-0.8.0-before-6.23.0-information-disclosure-via-setup-endpointnvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000