Ghost containers a missing authorization check that lets any authenticated member read the excerpts of posts they are not authorized to view. This flaw leaks sensitive teaser content that is intended to be protected behind access restrictions, compromising confidentiality of gated material. The vulnerability does not grant execution privileges but permits data disclosure to privileged users beyond their intended scope.

All Ghost installations running version 5.3.0 up to but not including 6.62.0. The issue affects every Ghost instance that deploys these releases, irrespective of hosting platform or configuration specifics, as the bug resides in the core excerpt handling logic.

The CVSS score of 6.9 indicates a moderate impact. Because the flaw requires an authenticated user, the attack vector is limited to legitimate site members who may already have legitimate access. No EPSS data is available, so the likelihood of exploitation cannot be quantified, and the vulnerability is not in the CISA KEV catalog. An attacker must be able to log in to the site but can then exploit the missing check to read excerpts intended to be gated, potentially revealing sensitive marketing or content previews.