UpHeron
All vulnerabilities

Servers and applications

GHSA-994c-84qf-j7q9

Members-only Content Exposed via Content API Plaintext and Excerpt Fields

Severity
Medium 5.3
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
6.77.0
Weakness
Information exposure (CWE-200)Incorrect authorization (CWE-863)
Attack
Over the network · No login needed · No user action needed
Attacker can
Read some data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Sources
Project advisories (GitHub)

Description

Under certain conditions, the public Content API returned the text of members-only and paid content to unauthenticated visitors. This affected posts that begin with a paywall card, and content blocks within a post whose visibility is limited to certain members, including on otherwise public posts.

Only the text of restricted posts or blocks was exposed. No member data was exposed.

For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.

If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.

From TryGhost/Ghost's security advisory.

Affected software

SoftwareAffected versions
GhostServers and applications · github:tryghost/ghost
  • From 5.109.0 before 6.77.0

References