CVE-2021-39192: Privilege escalation in Ghost package
Summary
CVE-2021-39192: Privilege escalation: all users can access Admin-level API keys. Affects ghost versions >= 4.0.0, < 4.10.0. Fixed in 4.10.0. How to fix ↓
Also tracked for
- ghost · Bitnami
The same CVE-2021-39192 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Ghost package is an open-source content management system (CMS) designed for creating and managing websites. It provides a user-friendly interface for content creation and publishing. The package includes features such as themes, templates, and integrations with various services. However, a vulnerability has been discovered in versions 4.0.0 to 4.9.4 of the Ghost package, which allows all authenticated users to access admin-level API keys. This privilege escalation vulnerability poses a risk of unauthorized access and potential misuse of sensitive data.
Vulnerability Detail
The vulnerability arises from an error in the implementation of the limits service in the affected versions of the Ghost package. It allows any authenticated user, including contributors, to view admin-level API keys through the integrations API endpoint. This flaw enables unauthorized users to elevate their privileges and gain access to sensitive information. Ghost(Pro) has already been patched, but self-hosted instances of Ghost running versions between 4.0.0 and 4.9.4 are affected. It is crucial to take immediate action to secure the site by upgrading to version 4.10.0 or applying the provided workaround.
How To Fix
Latest published version: 6.72.0 as of 22 Oct 2026
npm install ghost@6.72.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.10.0
This is the first release that contains the fix.
npm install ghost@4.10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 4.10.0 is not immediately feasible, a workaround is available. It involves disabling all non-Administrator accounts to prevent API access. By restricting API access to only Administrator accounts, the vulnerability can be mitigated. However, this workaround may impact the functionality and user experience of the affected Ghost instance.
Conclusion
The vulnerability in the Ghost package allows authenticated users to access admin-level API keys, leading to a privilege escalation risk. It is crucial for affected users to upgrade to version 4.10.0 or later, or apply the provided workaround of disabling non-Administrator accounts. Regenerating all API keys is also strongly advised. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghost →
FAQ
The vulnerability allows authenticated users, including contributors, to access admin-level API keys. This can lead to privilege escalation, enabling unauthorized users to view sensitive information and potentially perform malicious actions.
Versions 4.0.0 to 4.9.4 of the Ghost package are affected by this vulnerability.
Yes, Ghost(Pro) has already been patched to address this vulnerability.
Self-hosted instances of Ghost running versions between 4.0.0 and 4.9.4 should upgrade to version 4.10.0 as soon as possible. Alternatively, the workaround of disabling non-Administrator accounts can be applied.
Yes, it is highly recommended to regenerate all API keys after patching or applying the workaround to ensure the security of the system.
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
