CVE-2026-53943
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk15th percentile — higher than 15% of all known CVEs
Summary
Ghost is a Node.js content management system. In versions up to 6.37.0, when Ghost is behind a shared caching layer, an unauthenticated user could send an x-ghost-preview header that altered the rendered frontend response.
Risk Assessment
In affected cache configurations, that response could be stored and served to subsequent visitors, allowing malicious content modifications. This could lead to takeover of staff user accounts if the frontend and admin panel are on the same domain.
Recommendation
It is recommended to upgrade to version 6.37.0 or later to mitigate this vulnerability. Additionally, consider separating the frontend and admin panel onto different domains for enhanced security.
Original NVD description (English source)
Ghost is a Node.js content management system. From until 6.37.0, when Ghost is behind a shared caching layer that results in cached content being shared between different visitors, an unauthenticated user could send an x-ghost-preview header that altered the rendered frontend response. In affected cache configurations, that response could be stored and served to subsequent visitors requesting the same page, allowing cache poisoning of request-specific preview output. When running Ghost's frontend and admin panel on the same domain this could be used to take over staff user accounts. When running these on different domains staff accounts have no exposure. This vulnerability is fixed in 6.37.0.