High priorityDisclosed

Advisory · CVE-2026-103271

Ghost's paywall had a side door anyone could walk through

Ghost's content API let unauthenticated visitors retrieve gated post content directly, bypassing the paywall restrictions publishers rely on.

Advisory published October 1, 2026Independent summary
Vendor
Ghost
Product
Ghost
Identifier / CWE
CVE-2026-103271
CWE-863
Action timing
Immediate
ELI5

Explain it like I’m five

The magazine put its premium articles behind a locked door, but left the same articles sitting on an unlocked shelf around the corner. Anyone who knew where to look could read them for free.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Gated post published

    A publisher marks post content as gated, expecting only entitled members to read it.

  2. 02Content API queried

    An unauthenticated visitor queries the content API directly instead of going through the gated front end.

  3. 03Restriction skipped

    The API returns the restricted post content without enforcing the gating rules that should apply.

  4. 04Paywall bypassed

    The visitor reads paid content with no membership and no authentication.

What happened

Ghost’s security advisory GHSA-rcx7-6m7p-xw5c describes an incorrect-authorization flaw (CWE-863) in the content API. A vulnerability in the API allowed unauthenticated visitors to leak gated post content: attackers could bypass content restrictions by directly querying the content API to retrieve restricted posts without authentication.

The issue affects Ghost versions from 4.0.0 up to 6.63.0 and is fixed in 6.63.0. For publishers running memberships and paid tiers, every gated post in that range was effectively public to anyone who asked the API the right way.

What to do

  1. Upgrade to Ghost 6.63.0 or later.
  2. Review content API access logs for unauthenticated requests that returned gated content.
  3. If you run paid tiers, assess how much restricted content was exposed during the vulnerable window.
  4. Confirm the running version after upgrading and verify gating behaves as expected.

Management note

This is a revenue-trust bug as much as a security bug: the paywall was a suggestion, not a control. For publications selling exclusivity, the incident to manage is subscriber confidence, not just the upgrade.