https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-21T20:20:59.545286+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2021-39192 CVE-2021-39192 — Privilege escalation: all users can access Admin-level API keys 2026-10-21T20:20:59.546527+00:00

Affected: TryGhost Ghost

Ghost is a Node.js content management system. An error in the implementation of the limits service between versions 4.0.0 and 4.9.4 allows all authenticated users (including contributors) to view admin-level API keys via the integrations API endpoint, leading to a privilege escalation vulnerability. This issue is patched in Ghost version 4.10.0. As a workaround, disable all non-Administrator accounts to prevent API access. It is highly recommended to regenerate all API keys after patching or applying the workaround.