CVE-2026-53947
Description
Ghost is a Node.js content management system. From 5.18.0 until 6.21.1, a discrepancy in responses from the members signin endpoints made it possible for an unauthenticated attacker to determine whether a given email address belongs to a registered member of a Ghost site. This vulnerability is fixed in 6.21.1.
Summary dbcve.org
Ghost CMS versions 5.18.0 through 6.21.1 contain an information disclosure vulnerability in the members signin endpoint. The endpoint returns different responses (timing, error messages, or behavior) for registered vs. unregistered email addresses, allowing unauthenticated user enumeration. An attacker can determine if a specific email is registered as a member on the site.
Mitigation
Upgrade Ghost to version 6.21.1 or later, which contains the fix for consistent endpoint responses. Additionally, implement rate limiting on authentication endpoints to further mitigate enumeration attempts.