UpHeron
All vulnerabilities

Servers and applications

GHSA-vh3j-4gg7-7vjw

Revenue Data Exposed to Staff Users via Stats Endpoints

Severity
Medium 4.3
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
6.76.0
Weakness
Incorrect authorization (CWE-863)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read some data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Sources
Project advisories (GitHub)

Description

Staff users without access to member data, such as Contributors, Authors and Editors, could read the site's revenue and subscription statistics through the Admin API. This happened in two ways: several stats endpoints did not require member access, and on sites with the optional stats cache enabled, cached stats responses were returned without checking the requester's permissions. The stats cache is off by default.

No individual member records were exposed, and no data could be changed.

For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.

If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.

From TryGhost/Ghost's security advisory.

Workarounds

For the cached-response problem only: disable the stats cache by removing hostSettings.statsCache.enabled from your configuration. There is no configuration workaround for the stats endpoint permissions.

Workarounds as given by TryGhost/Ghost's security advisory.

Affected software

SoftwareAffected versions
GhostServers and applications · github:tryghost/ghost
  • From 5.77.0 before 6.76.0

References