A flaw in Ghost versions 4.0.0 through 6.62.9 permits anyone with web access to query the content API and retrieve posts that are normally gated behind authentication. The vulnerability enables unauthenticated visitors to bypass content restrictions and view restricted posts, resulting in the disclosure of confidential or sensitive material that should be protected. This behavior directly undermines the confidentiality safeguards built into the system.

The Ghost content management system released by TryGhost is affected. Every installation running a version from 4.0.0 up to, but not including, 6.63.0 is vulnerable. Site administrators should confirm the exact Ghost version in use to determine exposure.

The CVSS score of 8.7 indicates a high‑severity impact that can be exploited without authentication. EPSS data is not available, but the absence of any access controls on the API endpoint means an attacker can trivially acquire restricted content with only network reach to the target web server. The vulnerability is not listed in CISA’s KEV catalog, yet its ease of exploitation makes it a low‑effort, high‑impact risk for all affected sites.