CVE-2026-53949: Ghost Content API filter bypass reveals private fields
Ghost is a Node.js content management system. From 5.46.1 until 6.21.2, the validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully accessible. If MySQL was used as the database the password hashes' case (uppercase / lowercase) would have been lost, which would likely have rendered a further brute force attack on the discovered hashes fruitless. This vulnerability is fixed in 6.21.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghost (Node.js content management system)to a version that resolves this vulnerability.Fixed in 6.21.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53949?
The severity of CVE-2026-53949 is medium with a score of 5.3.
How do I fix CVE-2026-53949?
To fix CVE-2026-53949, update Ghost to version 6.21.2 or later.
What type of vulnerability is CVE-2026-53949?
CVE-2026-53949 is a vulnerability that allows for a bypass of filters on the public API endpoints, leading to information leakage.
What is the impact of CVE-2026-53949 on Ghost?
CVE-2026-53949 can potentially expose private fields through a brute force attack on the public API.
In which versions of Ghost is CVE-2026-53949 present?
CVE-2026-53949 exists in Ghost versions from 5.46.1 to 6.21.2.