CVE-2026-53949

Name of the Vulnerable Software and Affected Versions Ghost versions 5.46.1 through 6.21.1

Description Validation applied to filters on public API endpoints could be partially bypassed, allowing the disclosure of private fields through a brute force attack. The impact varies by database: when using SQLite, password hashes are fully accessible, whereas when using MySQL, the case sensitivity of password hashes is lost, which may hinder subsequent brute force attempts on the retrieved hashes.

Recommendations Update to version 6.21.2.