CVE-2026-53949: Ghost CMS Public API Filter Bypass Exposes Password Hashes

Technical summary

The vulnerability stems from insufficient input validation on filter parameters exposed through Ghost's public API endpoints. An attacker can craft requests that partially circumvent the intended access controls, allowing enumeration and extraction of sensitive fields normally restricted to authenticated users or specific contexts. The attack vector is unauthenticated and requires only network access (CVSS vector AV:N/AC:L/PR:N). The exposure is exacerbated by weak field-level access controls: if the backend uses SQLite, password hashes are returned in full, preserving their cryptographic properties for offline brute-force attacks. With MySQL, the case sensitivity of hash values is stripped during the filtering bypass, which degrades the viability of subsequent password cracking efforts due to reduced search space entropy.

Business impact

For organizations running Ghost with SQLite, this vulnerability creates a direct pathway to credential compromise. A successful attack yields usable password hashes that can be cracked offline, potentially granting attackers administrative or user account access to the CMS and any integrated services. For MySQL deployments, the impact is lower but still concerning: leaked hashes without case sensitivity are less likely to yield credentials quickly, but they confirm user identity and email associations, enabling targeted social engineering. The vulnerability does not allow data modification or system unavailability, but the confidentiality breach poses reputational risk and potential regulatory exposure (GDPR, CCPA) if user personal data is exposed.

Affected systems

Ghost versions from 5.46.1 through 6.21.1 (inclusive) are vulnerable. The fix is available in version 6.21.2. Organizations running Ghost should check their installed version immediately. Deployments using SQLite as the database backend face higher risk due to the complete leakage of password hashes; MySQL users experience reduced but non-zero risk. Any publicly exposed Ghost instances are at immediate risk of enumeration and brute-force attacks.

Exploitability

The attack requires no authentication and no user interaction. An attacker needs only network-level access to the public API endpoints and the ability to craft filter bypass requests. The exploit is straightforward: repeat requests with crafted filter parameters to enumerate private fields and extract sensitive data. No special tools or advanced techniques are required beyond basic HTTP requests. The primary barrier is discovering that the bypass exists and understanding which filter parameters leak which fields—a reconnaissance step that, once accomplished, enables reliable exploitation. The CVSS score of 5.3 (MEDIUM) reflects the ease of exploitation (AC:L, PR:N) balanced against limited impact scope (confidentiality only, no integrity or availability impact).

Remediation

Upgrade Ghost to version 6.21.2 or later immediately. This release includes hardened filter validation that properly blocks attempts to access restricted fields via public API endpoints. Organizations unable to upgrade immediately should consider temporarily disabling public API access if the instance handles sensitive user data, or implementing additional network controls (IP allowlisting, WAF rules) to restrict filter-based queries. Verify that any password hashes extracted during the vulnerability window are invalidated and users are forced to reset passwords.

Patch guidance

Apply the upgrade to Ghost 6.21.2 or any subsequent version in a controlled manner. Test in a staging environment first if your instance has custom plugins or integrations that depend on public API behavior. The fix is backward-compatible and does not require configuration changes. After upgrade, verify that API filter functionality still works as expected for legitimate queries while confirming that private field enumeration is blocked. Check your application logs for any suspicious filter-based API requests prior to patching, which may indicate prior exploitation attempts.

Detection guidance

Monitor API access logs for unusual patterns in filter parameters, particularly repeated requests with slight variations to filter clauses that target private fields. Look for requests attempting to filter on email, password_hash, or other sensitive attributes from unauthenticated sources. Network detection can focus on identifying excessive or rapid public API queries with complex filter syntax from a single source IP. Correlate timing of suspicious API activity with any user account compromise reports. If you have database-level logging, review queries for SELECT statements on sensitive columns that do not match your application's expected access patterns.

Why prioritize this

While the CVSS score is MEDIUM (5.3), the practical impact for SQLite deployments elevates this beyond routine patching. The vulnerability is straightforward to exploit, requires no privileges, and directly exposes password hashes. Organizations running Ghost with SQLite should prioritize this patch within days. MySQL deployments can follow normal patch windows but should not delay beyond a few weeks. The absence of KEV designation reflects the recency of disclosure (June 2026) and the fact that no public exploits or active wild exploitation have been documented at time of publication.

Risk score, explained

CVSS 5.3 (MEDIUM) is assigned due to: network-accessible attack vector with low complexity, requiring no privileges or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). The impact is limited to confidentiality (C:L); there is no integrity or availability impact (I:N/A:N), and the scope is unchanged (S:U). However, the practical risk is context-dependent: SQLite users face higher real-world risk because exposed hashes are immediately usable for offline cracking. MySQL users face lower real-world risk due to lost case sensitivity. The CVSS score does not differentiate these scenarios and should be considered a baseline; organizations should adjust internal risk ratings based on their database choice.

Frequently asked questions