CVE-2026-53947: Ghost: Member existence leak via magic link sign-in response
Impact
A discrepancy in responses from the members signin endpoints made it possible for an unauthenticated attacker to determine whether a given email address belongs to a registered member of a Ghost site.
Vulnerable versions
This vulnerability is present in Ghost from v5.18.0 up to v6.21.0.
Patches
v6.21.1 contains a fix for this issue.
How to update
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.
For more information
If you have any questions or comments about this advisory, email Ghost at security@ghost.org.
Other sources
Ghost is a Node.js content management system. From 5.18.0 until 6.21.1, a discrepancy in responses from the members signin endpoints made it possible for an unauthenticated attacker to determine whether a given email address belongs to a registered member of a Ghost site. This vulnerability is fixed in 6.21.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/ghostto a version that resolves this vulnerability.Fixed in 6.21.2 - Upgrade
Upgrade
Ghostto a version that resolves this vulnerability.Fixed in 6.21.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53947?
The severity of CVE-2026-53947 is classified as medium at 5.3.
How do I fix CVE-2026-53947?
To fix CVE-2026-53947, upgrade Ghost to version 6.21.2 or later.
What is CVE-2026-53947 about?
CVE-2026-53947 involves a member existence leak via magic link sign-in response in Ghost, allowing attackers to identify registered email addresses.
What versions of Ghost are affected by CVE-2026-53947?
CVE-2026-53947 affects Ghost versions from 5.18.0 until 6.21.1.
Who is at risk from CVE-2026-53947?
Unauthenticated attackers can exploit CVE-2026-53947 to determine if an email address is associated with a registered member of a Ghost site.