Medium severity4.3NVD Advisory· Published Oct 1, 2026

CVE-2026-103284

Description

Ghost versions from 5.125.1 before 6.57.1 contain an information disclosure vulnerability in the Admin Feedback endpoint that allows unauthorized staff users to access member data. Attackers with staff privileges can query the feedback endpoint to retrieve sensitive member information without proper authorization checks.

Affected products

Tryghost/Ghostllm-fuzzy
Range: >=5.125.1 <6.57.1

Patches

Vulnerability mechanics

References

github.com/TryGhost/Ghost/security/advisories/GHSA-vm82-r49m-224qnvd
www.vulncheck.com/advisories/ghost-5.125.1-before-6.57.1-information-disclosure-via-feedbacknvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000