CVE-2026-103271

HIGHCVSS 7.5

Description

Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts without authentication.

Timeline

Published:October 1st, 2026 11:17 AM

Last modified:October 6th, 2026 1:16 AM

CVSS Scoring

CVSS v3: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-863

References & Reports

Advisories, patches, and third-party reports

https://github.com/TryGhost/Ghost/security/advisories/GHSA-rcx7-6m7p-xw5c
https://www.vulncheck.com/advisories/ghost-4.0.0-before-6.63.0-restricted-content-bypass

Source: NIST NVD · Data may lag official sources by up to one minute