CVE-2026-103271: Ghost 4.0.0 before 6.63.0 Restricted Content Bypass
Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts without authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghostto a version that resolves this vulnerability.Fixed in 6.63.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated visitor who can reach the Ghost content API can attempt to retrieve gated posts. No credentials or user interaction are required.
Which deployments are affected?
Ghost versions from 4.0.0 up to, but not including, 6.63.0 are affected. Deployments that use gated or restricted post content are exposed to unauthorized disclosure of that content.
What is the practical impact?
An attacker can directly query the content API and obtain restricted post content without authenticating. The reported impact is loss of confidentiality; integrity and availability are not identified as affected.
How can I determine whether my site is vulnerable?
Confirm whether the Ghost version is between 4.0.0 and 6.62.x and whether restricted posts are served through the content API. Affected sites may allow an unauthenticated request to the content API to return gated post content.