CVE-2026-103284 Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback
Unauthorized staff users can access sensitive member data via the Admin Feedback endpoint due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-103284?
CVE-2026-103284 is a medium-severity missing authorization vulnerability in TryGhost Ghost, published on 1 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Ghost versions from 5.125.1 before 6.57.1 contain an information disclosure vulnerability in the Admin Feedback endpoint that allows unauthorized staff users to access member data. Attackers with staff privileges can query the feedback endpoint to retrieve sensitive member information without proper authorization checks.
Weakness: CWE-863
Which versions are affected by CVE-2026-103284?
1 open source package ship an affected version, including ghost.
| Package | Affected | Fixed in |
|---|---|---|
ghost Bitnami | From 5.125.1 | 6.57.1 |
How do I fix CVE-2026-103284?
Upgrade ghost to 6.57.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-103284 being exploited?
There is no known exploitation of CVE-2026-103284 in the wild and no public exploit code.
Sources
Also known as BIT-ghost-2026-103284, GHSA-vm82-r49m-224q, GHSA-wm9p-jg8j-w38q, MINI-6jw4-3m3f-hvq7.