CVE-2026-53947: Ghost is a Node.js content management system. From 5.18.0 until 6.21.1, a discrepancy in responses from the members sign…
Ghost is a Node.js content management system. From 5.18.0 until 6.21.1, a discrepancy in responses from the members signin endpoints made it possible for an unauthenticated attacker to determine whether a given email address belongs to a registered member of a Ghost site. This vulnerability is fixed in 6.21.1.
- Published by source
- 2026-06-24
- First seen by Reality Radar
- 2026-10-26
- Last verified
- 2026-10-26
What the official notice says
Risk: CVSS 5.3
Is this affecting you?
Add what you own or use and Reality Radar will tell you when official changes match it — with evidence and next steps.
Sources
- NIST National Vulnerability Database Tier A · official published 2026-06-24
Evidence ledger
Every piece of evidence we store is appended to a public hash chain, so later edits are detectable. Anyone can re-verify it.
| Entry | Kind | Observed | Evidence hash | Entry hash |
|---|---|---|---|---|
| #1742 | new | 2026-10-26 | 490b604b1338…6cfa11 | e7391826530e…0a0adf |
Chain head: #1771 9d8a5938d304…171807