PT-2026-103816 · Ghost · Ghost
CVSS v4.0
5.3
متوسطة
| المتجه | AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Ghost versions 5.125.1 through 6.57.0
Description
An information disclosure issue exists in the Admin Feedback endpoint. Staff users with limited privileges can query this endpoint to retrieve sensitive member data because the system fails to perform proper authorization checks.
Recommendations
Update Ghost to version 6.57.1 or later.
Restrict access to the Admin Feedback endpoint for staff users with low privilege levels as a temporary mitigation.
استغلال
إصلاح
Incorrect Authorization
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Ghost