CVE-2021-39192

    Dashboard / Vulnerabilities / CVE-2021-39192

    CVE-2021-39192

    Published: 3 Sept 2021Last Modified: 7 Aug 2026

    Summary:

    Details: Ghost is a Node.js content management system. An error in the implementation of the limits service between versions 4.0.0 and 4.9.4 allows all authenticated users (including contributors) to view admin-level API keys via the integrations API endpoint, leading to a privilege escalation vulnerability. This issue is patched in Ghost version 4.10.0. As a workaround, disable all non-Administrator accounts to prevent API access. It is highly recommended to regenerate all API keys after patching or applying the workaround.

    References: https://github.com/TryGhost/Ghost/releases/tag/v4.10.0, https://github.com/TryGhost/Ghost/security/advisories/GHSA-j5c2-hm46-wp5c

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 6058ee39069f83c698cc0c8d4492a4dfd2c4eed2
    Fixed -62d31bc65d92e2893358abc9e01f0b02fb31ae00

    Affected versions

    v4.9.1
    v4.9.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-39192 | CVE-DB