CVE-2026-53947: CVE-2026-53947: Observable Response Discrepancy (User Enumeration) in Ghost CMS

CVE-2026-53947: Observable Response Discrepancy (User Enumeration) in Ghost CMS

Vulnerability ID: CVE-2026-53947
CVSS Score: 5.3
Published: 2026-08-04

CVE-2026-53947 is an observable response discrepancy (CWE-204) in Ghost CMS that permits unauthenticated remote user enumeration via the passwordless magic link sign-in endpoint.

TL;DR

Ghost CMS versions 5.18.0 through 6.21.1 allow unauthenticated attackers to enumerate registered member email addresses due to distinct HTTP response codes and messages returned by the magic link sign-in endpoint. Upgrading to 6.21.1 mitigates this.

---

Technical Details

• CWE ID: CWE-204 (Observable Response Discrepancy)
• Attack Vector: Network (Remote, Unauthenticated)
• CVSS Score: 5.3 (Medium)
• EPSS Score: 0.00206 (Percentile: 10.84%)
• Impact: User Enumeration
• Exploit Status: None (No public weaponized exploit available)
• KEV Status: Not Listed in CISA KEV

Affected Systems

• Ghost CMS
• Ghost: >= 5.18.0, < 6.21.1 (Fixed in: 6.21.1)

Code Analysis

Commit: fb2bb63

Response normalization for magic link requests

Mitigation Strategies

• Upgrade Ghost CMS to version 6.21.1 or higher.
• Apply rate limiting on the /members/api/send-magic-link endpoint.
• Implement WAF monitoring rules.

Remediation Steps:

1. Verify current Ghost version running in production.
2. Update Ghost dependency to version 6.21.1 or newer.
3. Redeploy the application and verify portal authentication functions.
4. Configure IP-based rate limiting on reverse proxy for magic-link endpoints.
5. Monitor log traffic to detect outstanding scanning signatures.

References

• Official Security Advisory
• Official Fix Commit
• Pull Request
• Official Release
• CVE.org Record
• NVD Vuln Detail

---

Read the full report for CVE-2026-53947 on our website for more details including interactive diagrams and full exploit analysis.