CVE-2026-53947 Ghost: Member existence leak via magic link sign-in response
Unauthenticated attackers can determine if an email is registered by analyzing magic link sign-in response discrepancies in Ghost CMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53947?
CVE-2026-53947 is a medium-severity vulnerability in TryGhost Ghost, published on 24 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Ghost is a Node.js content management system. From 5.18.0 until 6.21.1, a discrepancy in responses from the members signin endpoints made it possible for an unauthenticated attacker to determine whether a given email address belongs to a registered member of a Ghost site. This vulnerability is fixed in 6.21.1.
Weakness: CWE-204
Which versions are affected by CVE-2026-53947?
3 open source packages ship an affected version, including ghost.
| Package | Affected | Fixed in |
|---|---|---|
ghost Bitnami | From 5.18.0 | 6.21.1 |
ghost npm | From 5.18.0 | 6.21.2 |
ghost npm | From 5.18.0 | 6.21.2 |
How do I fix CVE-2026-53947?
Upgrade ghost to a fixed version for your release line: 6.21.1 or 6.21.2.
Is CVE-2026-53947 being exploited?
There is no known exploitation of CVE-2026-53947 in the wild and no public exploit code.
Sources
Also known as BIT-ghost-2026-53947, GHSA-chgm-3698-jm42.