CVE-2023-31133highCWE-200

CVE-2023-31133: high-severity vulnerability in TryGhost Ghost

Ghost vulnerable to disclosure of private API fields

Published · Updated

Follow this CVE+ Monitor Ghost+ Monitor ghost

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 46%
Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members. Prior to version 5.46.1, due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute force attack. Ghost(Pro) has already been patched. Maintainers can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added. Self-hosters are impacted if running Ghost a version below v5.46.1. v5.46.1 contains a fix for this issue. As a workaround, add a block for requests to `/ghost/api/content/*` where the `filter` query parameter contains `password` or `email`.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
TryGhost · Ghost
Related CVEs — TryGhost Ghost

In the same product, most dangerous first.

CVE-2026-26980CRITICALGhost has a SQL Injection in its Content APIEPSS 71.1%CVE-2023-40028MEDIUMArbitrary file read via symlinks in GhostEPSS 69.0%CVE-2021-29484MEDIUMDOM XSS in Theme PreviewEPSS 7.9%CVE-2026-29053HIGHGhost Vulnerable to Remote Code Execution via Malicious ThemesEPSS 4.9%CVE-2026-22594HIGHGhost has Staff 2FA bypassEPSS 1.3%CVE-2021-39192MEDIUMPrivilege escalation: all users can access Admin-level API keysEPSS 1.0%