Vulnerability record · CVE-2023-31133 · published 8 May 2023
CVE-2023-31133: Ghost public API filter validation flaw exposes private fields
Ghost · Ghost
Ghost versions before 5.46.1 fail to validate the filter query parameter on public content API endpoints, allowing private fields to be revealed through brute force. The flaw is an information exposure issue in a widely used publishing platform, and self-hosted instances below v5.46.1 are affected.
Description
Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members. Prior to version 5.46.1, due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute force attack. Ghost(Pro) has already been patched. Maintainers can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added. Self-hosters are impacted if running Ghost a version below v5.46.1. v5.46.1 contains a fix for this issue. As a workaround, add a block for requests to `/ghost/api/content/*` where the `filter` query parameter contains `password` or `email`.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Automated analysis
high priorityUnauthenticated network-reachable information exposure with high confidentiality impact and very high EPSS percentile, though no confirmed in-the-wild exploitation.
What it is
Ghost versions before 5.46.1 fail to validate the filter query parameter on public content API endpoints, allowing private fields to be revealed through brute force. The flaw is an information exposure issue in a widely used publishing platform, and self-hosted instances below v5.46.1 are affected.
Impact
An unauthenticated attacker can recover private fields such as email and password data by iterating filter values, exposing sensitive member information.
Attack surface
Reachable over the network via the public /ghost/api/content/* endpoints using the filter query parameter; no authentication or user interaction is required per the CVSS vector.
Exploitation
Not listed in CISA KEV and no public exploit references are provided, but EPSS is 0.45713 (98.7th percentile), indicating elevated predicted exploitation likelihood.
What to do
- Upgrade Ghost to v5.46.1 or later; Ghost(Pro) is already patched.
- If immediate upgrade is not possible, block requests to /ghost/api/content/* where the filter query parameter contains password or email.
- Audit public API access logs for filter parameters referencing password or email fields.
- Restrict or rate-limit public content API endpoints where feasible.
Detection
- Search web/proxy logs for requests to /ghost/api/content/* with filter parameters containing password or email.
- Alert on high-volume or sequential filter values from a single source against content API endpoints.
- Monitor for anomalous enumeration patterns against Ghost public API paths.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2023-31133 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-31133), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
