CVE-2026-53949

Ghost is a Node.js content management system. From 5.46.1 until 6.21.2, the validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully accessible. If MySQL was used as the database the password hashes' case (uppercase / lowercase) would have been lost, which would likely have rendered a further brute force attack on the discovered hashes fruitless. This vulnerability is fixed in 6.21.2.

• CWE-200
• CWE-693

• https://github.com/TryGhost/Ghost/security/advisories/GHSA-jx35-x7fj-vgpr

Published

Jun 24, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53943Ghost is a Node.js content management system. From until 6.…9.6
• CVE-2026-53944Ghost is a Node.js content management system. From 6.0.9 unt…5.8
• CVE-2026-53945Ghost is a Node.js content management system. From 6.0.9 unt…4
• CVE-2026-53946Ghost is a Node.js content management system. From 6.19.4 un…5.4
• CVE-2026-53947Ghost is a Node.js content management system. From 5.18.0 un…5.3
• CVE-2026-53948Ghost is a Node.js content management system. From 6.19.4 un…5.4
• CVE-2026-5395The Fluent Forms – Customizable Contact Forms, Survey, Quiz,…8.2
• CVE-2026-53950@tryghost/activitypub is Ghost’s social/federation client ap…7.5
• CVE-2026-53951Copier is a library and CLI app for rendering project templa…8.8
• CVE-2026-5396The Fluent Forms plugin for WordPress is vulnerable to Autho…8.2
• CVE-2026-53961Discourse is an open-source discussion platform. Prior to 20…6.5
• CVE-2026-53962Discourse is an open-source discussion platform. Prior to 20…5.4