[ CVE-2026-103281 · Published 1 Oct 2026 ]
Vulnerability in TryGhost Ghost
CVSS 5.4
EPSS <1%No fix listed yet
[ Description ]Official description
Ghost (npm package 'ghost') versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.