CVE-2026-53947
published 2026-06-24CVE-2026-53947: Ghost is a Node.js content management system. From 5.18.0 until 6.21.1, a discrepancy in responses from the members signin endpoints made it possible for an…
PriorityP431medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.34%
25.7th percentile
Ghost is a Node.js content management system. From 5.18.0 until 6.21.1, a discrepancy in responses from the members signin endpoints made it possible for an unauthenticated attacker to determine whether a given email address belongs to a registered member of a Ghost site. This vulnerability is fixed in 6.21.1.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ghost | ghost | >= 5.18.0 < 6.21.2 | 6.21.2 |
| tryghost | ghost | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Ghost: Member existence leak via magic link sign-in response
ghsa·2026-08-04
CVE-2026-53947 [MEDIUM] CWE-204 Ghost: Member existence leak via magic link sign-in response
Ghost: Member existence leak via magic link sign-in response
### Impact
A discrepancy in responses from the members signin endpoints made it possible for an unauthenticated attacker to determine whether a given email address belongs to a registered member of a Ghost site.
### Vulnerable versions
This vulnerability is present in Ghost from v5.18.0 up to v6.21.0.
### Patches
v6.21.1 contains a fix for this issue.
### How to update
For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost).
If your Ghost is a Ghost-CLI install see our documentation on [updating it to the latest version here](https://docs.ghost.org/update).
#
VulDB
TryGhost up to 6.21.0 response discrepancy
vuldb·2026-06-24·CVSS 5.3
CVE-2026-53947 [MEDIUM] TryGhost up to 6.21.0 response discrepancy
A vulnerability, which was classified as problematic, was found in TryGhost Ghost up to 6.21.0. Affected by this vulnerability is an unknown functionality. The manipulation results in observable response discrepancy.
This vulnerability is cataloged as CVE-2026-53947. The attack may be launched remotely. There is no exploit available.
You should upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-24
Published