CVE-2026-103272CWE-203

CVE-2026-103272

High · published October 1, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
29.1
In the wild
Unconfirmed
What it is

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without authentication.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00365 · 29.1th percentile
Weakness
CWE-203 · Observable Discrepancy
Published
2026-10-01T15:17Z
References (2)
https://github.com/TryGhost/Ghost/security/advisories/GHSA-ffmj-3ppp-cj4r · [email protected]https://www.vulncheck.com/advisories/ghost-2.10.0-before-6.63.0-staff-enumeration-via-content-api · [email protected]
EPSS history
Timeline
  • 03 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 01 OCT 10:42Z
    Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API
    cvelistv5