Description
Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of posts they do not have access to (gated content).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TryGhost | Ghost | 5.3.0 – < 6.62.0 | 6.62.0 |
References
- GitHub Security Advisory (GHSA-rv92-9vfp-2826) vendor-advisory
- VulnCheck Advisory: Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts third-party-advisory