high7.5
CVE-2026-103272
Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data.
Impact
Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without authentication.
Affected products
| Product | Affected versions |
|---|---|
| Ghost Versions From 2.10.0 | before 6.63.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.