CVE-2026-103271: Tryghost Ghost

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts without authentication.

Affected products

• Tryghost Ghost: from 4.0.0, before 6.63.0 (fixed in 6.63.0)

Published 2026-10-01. Last modified 2026-10-06.