What is GHSA-crq6-86x9-65hj?

GHSA-crq6-86x9-65hj is a security advisory published by GitHub Security Advisories with Medium severity. Ghost (npm package 'ghost') versions from 3.23.0 up to, but not including, 6.23.0 expose API keys...

Which CVE IDs does GHSA-crq6-86x9-65hj cover?

GHSA-crq6-86x9-65hj covers the following CVE IDs: CVE-2026-103281. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-crq6-86x9-65hj?

GHSA-crq6-86x9-65hj has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

GHSA-crq6-86x9-65hjMediumCVSS 5.4

Ghost (npm package 'ghost') versions from 3.23.0 up to, but not including, 6.23.0 expose API keys...

Vendor

GitHub Security Advisories

Published

October 1, 2026

Last Modified

October 1, 2026

🔗 CVE IDs covered (1)

CVE-2026-103281 →

📋 Description

Ghost (npm package 'ghost') versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users.

🔗 References (4)

https://github.com/TryGhost/Ghost/security/advisories/GHSA-q98w-jm4q-wch7
https://nvd.nist.gov/vuln/detail/CVE-2026-103281
https://www.vulncheck.com/advisories/ghost-3.23.0-before-6.23.0-api-key-exposure-via-admin-api
https://github.com/advisories/GHSA-crq6-86x9-65hj