https://vulnerability.circl.lu/sightings/feed 2026-08-05T18:11:08.215521+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/d50a17e0-73eb-42cc-9b8d-797880afc632/export 2026-08-05T18:11:08.221937+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "d50a17e0-73eb-42cc-9b8d-797880afc632", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-chgm-3698-jm42", "type": "seen", "source": "https://gist.github.com/alon710/c4a761947b80459c983e02321c736c9a", "content": "# CVE-2026-53947: CVE-2026-53947: Observable Response Discrepancy (User Enumeration) in Ghost CMS\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-53947\n\n## Summary\nCVE-2026-53947 is an observable response discrepancy (CWE-204) in Ghost CMS that permits unauthenticated remote user enumeration via the passwordless magic link sign-in endpoint.\n\n## TL;DR\nGhost CMS versions 5.18.0 through 6.21.1 allow unauthenticated attackers to enumerate registered member email addresses due to distinct HTTP response codes and messages returned by the magic link sign-in endpoint. Upgrading to 6.21.1 mitigates this.\n\n## Technical Details\n\n- **CWE ID**: CWE-204 (Observable Response Discrepancy)\n- **Attack Vector**: Network (Remote, Unauthenticated)\n- **CVSS Score**: 5.3 (Medium)\n- **EPSS Score**: 0.00206 (Percentile: 10.84%)\n- **Impact**: User Enumeration\n- **Exploit Status**: None (No public weaponized exploit available)\n- **KEV Status**: Not Listed in CISA KEV\n\n## Affected Systems\n\n- Ghost CMS\n- **Ghost**: >= 5.18.0, < 6.21.1 (Fixed in: `6.21.1`)\n\n## Mitigation\n\n- Upgrade Ghost CMS to version 6.21.1 or higher.\n- Apply rate limiting on the `/members/api/send-magic-link` endpoint.\n- Implement WAF monitoring rules.\n\n**Remediation Steps:**\n1. Verify current Ghost version running in production.\n2. Update Ghost dependency to version 6.21.1 or newer.\n3. Redeploy the application and verify portal authentication functions.\n4. Configure IP-based rate limiting on reverse proxy for magic-link endpoints.\n5. Monitor log traffic to detect outstanding scanning signatures.\n\n## References\n\n- [Official Security Advisory](https://github.com/TryGhost/Ghost/security/advisories/GHSA-chgm-3698-jm42)\n- [Official Fix Commit](https://github.com/TryGhost/Ghost/commit/fb2bb634653d99de68fc42d415721d755284fe30)\n- [Pull Request](https://github.com/TryGhost/Ghost/pull/26752)\n- [Official Release](https://github.com/TryGhost/Ghost/releases/tag/v6.21.1)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-53947)\n- [NVD Vuln Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-53947)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-53947) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T00:00:39.583166Z"} 2026-08-05T00:00:39.583166+00:00 https://vulnerability.circl.lu/sighting/ca784264-ec24-42b9-b1ae-aa574fd41bef/export 2026-08-05T18:11:08.223326+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "ca784264-ec24-42b9-b1ae-aa574fd41bef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-chgm-3698-jm42", "type": "seen", "source": "https://gist.github.com/alon710/c4a761947b80459c983e02321c736c9a", "content": "# CVE-2026-53947: CVE-2026-53947: Observable Response Discrepancy (User Enumeration) in Ghost CMS\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-53947\n\n## Summary\nCVE-2026-53947 is an observable response discrepancy (CWE-204) in Ghost CMS that permits unauthenticated remote user enumeration via the passwordless magic link sign-in endpoint.\n\n## TL;DR\nGhost CMS versions 5.18.0 through 6.21.1 allow unauthenticated attackers to enumerate registered member email addresses due to distinct HTTP response codes and messages returned by the magic link sign-in endpoint. Upgrading to 6.21.1 mitigates this.\n\n## Technical Details\n\n- **CWE ID**: CWE-204 (Observable Response Discrepancy)\n- **Attack Vector**: Network (Remote, Unauthenticated)\n- **CVSS Score**: 5.3 (Medium)\n- **EPSS Score**: 0.00206 (Percentile: 10.84%)\n- **Impact**: User Enumeration\n- **Exploit Status**: None (No public weaponized exploit available)\n- **KEV Status**: Not Listed in CISA KEV\n\n## Affected Systems\n\n- Ghost CMS\n- **Ghost**: >= 5.18.0, < 6.21.1 (Fixed in: `6.21.1`)\n\n## Mitigation\n\n- Upgrade Ghost CMS to version 6.21.1 or higher.\n- Apply rate limiting on the `/members/api/send-magic-link` endpoint.\n- Implement WAF monitoring rules.\n\n**Remediation Steps:**\n1. Verify current Ghost version running in production.\n2. Update Ghost dependency to version 6.21.1 or newer.\n3. Redeploy the application and verify portal authentication functions.\n4. Configure IP-based rate limiting on reverse proxy for magic-link endpoints.\n5. Monitor log traffic to detect outstanding scanning signatures.\n\n## References\n\n- [Official Security Advisory](https://github.com/TryGhost/Ghost/security/advisories/GHSA-chgm-3698-jm42)\n- [Official Fix Commit](https://github.com/TryGhost/Ghost/commit/fb2bb634653d99de68fc42d415721d755284fe30)\n- [Pull Request](https://github.com/TryGhost/Ghost/pull/26752)\n- [Official Release](https://github.com/TryGhost/Ghost/releases/tag/v6.21.1)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-53947)\n- [NVD Vuln Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-53947)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-53947) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T23:31:07.884835Z"} 2026-08-04T23:31:07.884835+00:00