Summary
Ghost versions from 2.10.0 before 6.63.0 may disclose staff membership and related user information through discrepancies in Content API metadata responses. An unauthenticated attacker could compare these responses to enumerate staff members and gather sensitive account data.
Affected context
The vulnerability occurs in Ghost deployments within the affected version range when the Content API exposes metadata whose responses differ based on the presence or status of staff accounts. It becomes risky when the API is publicly reachable and response details provide enough information for an unauthenticated party to distinguish staff-related records.
Exploit preconditions
- Attack surface: Publicly accessible Ghost Content API endpoints
- Required access: No authentication may be required
- Trigger point: Requests that return metadata with distinguishable response differences
- Why exploitation is possible: Observable discrepancies can reveal whether staff-related data exists and may expose associated user information
Why this happens
The underlying issue is an information exposure caused by inconsistent API response behavior. Metadata differences reveal facts about records or account roles that should not be distinguishable to unauthenticated clients. This maps to CWE-203: Observable Discrepancy, where variations in externally visible output allow an attacker to infer sensitive information.
Potential impact
- An attacker may enumerate Ghost staff members
- User or account-related information could be exposed
- Organizations may experience increased targeting of administrative users
- Disclosed metadata can support phishing, reconnaissance, or follow-on attacks
General mitigation guidance
Mitigation generally focuses on reducing information differences in public API
responses and limiting exposure of staff-related metadata.
Common defensive patterns include:
- Returning consistent responses for authorized and unauthorized queries where practical
- Excluding staff and sensitive account attributes from public API output by default
- Enforcing authorization checks before resolving account-related metadata
- Minimizing identifiers and metadata that are unnecessary for public consumers
- Applying least privilege to API access and separating public content from administrative data
- Monitoring and rate-limiting repeated enumeration-oriented requests
How teams detect issues like this
Organizations can assess for this class of issue through:
- Dynamic testing that compares API responses across valid, invalid, and staff-related identifiers
- Static and code review checks for conditional response fields or status differences tied to account existence
- API schema reviews that identify staff data exposed through public resources
- Policy enforcement requiring explicit authorization for administrative metadata
- Monitoring for repeated unauthenticated requests that probe resource existence or response discrepancies
