CVE-2026-103272 Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API
Unauthenticated attackers can enumerate staff members and leak user data via the Content API in Ghost CMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-103272?
CVE-2026-103272 is a high-severity vulnerability in TryGhost Ghost, published on 1 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without authentication.
Weakness: CWE-203
Which versions are affected by CVE-2026-103272?
1 open source package ship an affected version, including ghost.
| Package | Affected | Fixed in |
|---|---|---|
ghost Bitnami | From 2.10.0 | 6.63.0 |
How do I fix CVE-2026-103272?
Upgrade ghost to 6.63.0 or later.
Is CVE-2026-103272 being exploited?
There is no known exploitation of CVE-2026-103272 in the wild and no public exploit code.
Sources
Also known as BIT-ghost-2026-103272, GHSA-ffmj-3ppp-cj4r, GHSA-jh5v-v5x3-c3pp, MINI-xw3g-4p8f-wcj3.