Security: TryGhost/Ghost
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Input Validation Issue in Admin iframe Could Result in Staff Account TakeoverGHSA-5pxf-whwv-g54g published
Aug 13, 2026 by acburdineHigh -
Staff Sessions not fully Invalidated on Password ChangeGHSA-v9vj-6fq5-99xj published
Aug 13, 2026 by acburdineModerate -
Information Disclosure in Setup EndpointGHSA-5685-hwm9-62cg published
Aug 13, 2026 by acburdineModerate -
API Keys Exposed to Low-Privilege StaffGHSA-q98w-jm4q-wch7 published
Aug 12, 2026 by acburdineModerate -
Invite Tokens could be Used Multiple TimesGHSA-vf9h-87xm-g767 published
Aug 12, 2026 by acburdineModerate -
Email 2FA Bypass When Switching UsersGHSA-q55r-w7fh-rmh6 published
Aug 13, 2026 by acburdineHigh -
Feedback Endpoint Returned Member Data to Unauthorized Staff UsersGHSA-vm82-r49m-224q published
Aug 13, 2026 by acburdineModerate -
Cross-Site Request Forgery in Post FeedbackGHSA-mf3j-vxq2-vmc4 published
Aug 13, 2026 by acburdineModerate -
Privilege Escalation in NotificationsGHSA-pv24-pfvg-vr83 published
Aug 11, 2026 by acburdineHigh -
Server-Side Request Forgery in Webhook TriggerGHSA-354h-gmhv-mr9c published
Aug 11, 2026 by acburdineLow