CVE-2026-103280: Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint
Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote visitor to obtain it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghostto a version that resolves this vulnerability.Fixed in 6.23.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote visitor can request the affected setup endpoint without authentication. No privileges or user interaction are required.
What information is exposed?
The endpoint discloses the site owner's email address. The provided data does not indicate exposure of other information.
Which deployments are affected?
Ghost versions from 0.8.0 through versions before 6.23.0 are affected. Because the endpoint is accessible without authentication, publicly reachable instances are exposed to unauthenticated requests.