Information Disclosure in Ghost by TryGhost

CVE-2026-103280

What is CVE-2026-103280?

The Ghost platform versions prior to 6.23.0 are susceptible to an information disclosure vulnerability. This occurs in the setup endpoint, which inadvertently reveals the site owner's email address in response to unauthenticated requests. This flaw allows any remote user to access sensitive information, posing a potential threat to the privacy and security of the site's owner. Website operators using affected versions of Ghost are encouraged to upgrade to the latest release to mitigate the risk of unauthorized data exposure.

References