{"id":"EUVD-2026-39020","enisaUuid":"5f6ce044-c4ee-31b4-9ee9-b3f346fc712d","description":"Ghost is a Node.js content management system. From 5.46.1 until 6.21.2, the validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully accessible. If MySQL was used as the database the password hashes\u0027 case (uppercase / lowercase) would have been lost, which would likely have rendered a further brute force attack on the discovered hashes fruitless. This vulnerability is fixed in 6.21.2.","datePublished":"Jun 24, 2026, 6:05:29 PM","dateUpdated":"Jun 24, 2026, 6:55:24 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-jx35-x7fj-vgpr\n","aliases":"CVE-2026-53949\nGHSA-jx35-x7fj-vgpr\n","assigner":"GitHub_M","epss":0.36,"enisaIdProduct":[{"id":"b9223975-5958-35c0-bee7-141adfb6b2ba","product":{"name":"Ghost","vendor":{"name":"TryGhost"}},"product_version":"5.46.1, \u003c 6.21.2"}],"enisaIdVendor":[{"id":"3a40eaee-0796-3597-b796-d7703ed08c7a","vendor":{"name":"TryGhost"}}],"enisaIdVulnerability":[{"id":"2a7d884b-276e-3ed0-95dc-4e16755b4932","vulnerability":{"id":"GHSA-jx35-x7fj-vgpr","description":"Ghost Content API filter bypass reveals private fields","datePublished":"Aug 5, 2026, 2:42:47 PM","dateUpdated":"Aug 5, 2026, 2:42:47 PM","baseScore":0.0,"references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-jx35-x7fj-vgpr\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53949\nhttps://github.com/TryGhost/Ghost\nhttps://github.com/TryGhost/Ghost/releases/tag/v6.21.2\n","enisa_id":"EUVD-2026-39020\n","aliases":"CVE-2026-53949\nGHSA-jx35-x7fj-vgpr\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:49 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"774e21fc-7b3c-324a-b019-d3f80fa9fd4f","vulnerability":{"id":"CVE-2026-53949","description":"Ghost is a Node.js content management system. From 5.46.1 until 6.21.2, the validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully accessible. If MySQL was used as the database the password hashes\u0027 case (uppercase / lowercase) would have been lost, which would likely have rendered a further brute force attack on the discovered hashes fruitless. This vulnerability is fixed in 6.21.2.","datePublished":"Jun 24, 2026, 6:05:29 PM","dateUpdated":"Jun 24, 2026, 6:55:24 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-jx35-x7fj-vgpr\n","enisa_id":"EUVD-2026-39020\n","assigner":"GitHub_M","epss":0.36,"dataProcessed":"Nov 7, 2026, 7:20:34 AM","vulnerabilityProduct":[{"id":"e072c41f-5c6c-34f8-8559-48890c87bb11","product":{"name":"Ghost","vendor":{"name":"TryGhost"}},"product_version":"5.46.1, \u003c 6.21.2"}],"vulnerabilityVendor":[{"id":"f5a87654-ff81-3c30-83f4-e2ac7022906d","vendor":{"name":"TryGhost"}}]}}],"enisaIdAdvisory":[]}