Medium
Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API
Ghost (npm package 'ghost') versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users.
Announced Group revision 1
Original source ↗CVE-2026-103281
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-103281
Ghost
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "TryGhost",
"product": "Ghost",
"versions": [
{
"status": "affected",
"version": "3.23.0",
"lessThan": "6.23.0",
"versionType": "semver"
}
],
"packageURL": "pkg:npm/ghost",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-103281
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #5190 · Revision 1
- Added to Heist Feed
- Publisher date