CVE-2026-103271 — Ghost 4.0.0 before 6.63.0 Restricted Content Bypass
Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restr…
Published: 2026-10-01 · CVSS: 8.7 · CVSS 4.0
Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts without authentication.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7