Viewing the system event log fails with an error after resetting all authentication

[ellotheth]

Issue Summary

I used the new Reset all authentication action in my Ghost site, then tried to view History in my blog's admin settings after I set a password and logged in successfully. I got an infinite spinner and an error notification:

Request:

GET /ghost/api/admin/actions/?include=actor%2Cresource&limit=200&filter=resource_type%3A-%5Blabel%5D HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:152.0) Gecko/20100101 Firefox/152.0
Accept: */*
Accept-Language: en,en-US;q=0.9,nb;q=0.8,no;q=0.7
Accept-Encoding: gzip, deflate, br, zstd
Referer: https://example.com/ghost/
app-pragma: no-cache
DNT: 1
Sec-GPC: 1
Connection: keep-alive
Cookie: <redacted>
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Priority: u=4
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

Response:

HTTP/2 500 
server: nginx/1.22.1
date: Thu, 28 May 2026 06:23:20 GMT
content-type: application/json; charset=utf-8
content-length: 381
x-powered-by: Express
content-version: v6.42
vary: Accept-Version, Accept-Encoding
cache-control: no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0
etag: <redacted>
x-content-type-options: nosniff
X-Firefox-Spdy: h2

{
	"errors": [
		{
			"message": "Internal server error, cannot list actions.",
			"context": "An unexpected error occurred, please try again. The target polymorphic type \"security_action\" is not one of the defined target types",
			"type": "InternalServerError",
			"details": null,
			"property": null,
			"help": null,
			"code": "UNEXPECTED_ERROR",
			"id": "27cd9980-5a5d-11f1-aa7b-535d62af232f",
			"ghostErrorCode": null
		}
	]
}

Steps to Reproduce

1. Log in to the admin dashboard as an admin user.
2. Perform the Reset all authentication action.
3. Follow the process to reset your password and log in again.
4. Navigate to /ghost/#/settings/history/view

Expected: I see a timeline of system events.
Actual: I see an infinite spinner, an error notification, and no timeline.

Ghost Version

6.42.0

Node.js Version

22.19.18

How did you install Ghost?

I'm running the ghost:6-alpine Docker container.

Database type

MySQL 8

Browser & OS version

Firefox 152.0b1

Relevant log / error output

ghost-cacie  | [2026-05-28 06:27:31] ERROR "GET /ghost/api/admin/actions/?include=actor%2Cresource&limit=200&filter=resource_type%3A-%5Blabel%5D" 500 67ms
ghost-cacie  | 
ghost-cacie  | An unexpected error occurred, please try again.
ghost-cacie  | 
ghost-cacie  | "The target polymorphic type \"security_action\" is not one of the defined target types"
ghost-cacie  | 
ghost-cacie  | Error ID:
ghost-cacie  |     4e4c6090-5a5e-11f1-aa7b-535d62af232f
ghost-cacie  | 
ghost-cacie  | Error Code: 
ghost-cacie  |     UNEXPECTED_ERROR
ghost-cacie  | 
ghost-cacie  | ----------------------------------------
ghost-cacie  | 
ghost-cacie  | Error: The target polymorphic type "security_action" is not one of the defined target types
ghost-cacie  |     at prepareError (/var/lib/ghost/versions/6.42.0/node_modules/.pnpm/@tryghost+mw-error-handler@1.0.13/node_modules/@tryghost/mw-error-handler/lib/mw-error-handler.js:113:19)
ghost-cacie  |     at Object.morphCandidate (/var/lib/ghost/versions/6.42.0/node_modules/.pnpm/bookshelf@1.2.0_knex@2.4.2_mysql2@3.18.1_@types+node@22.19.18__sqlite3@5.1.7_/node_modules/bookshelf/lib/helpers.js:140:13)
ghost-cacie  |     at /var/lib/ghost/versions/6.42.0/node_modules/.pnpm/bookshelf@1.2.0_knex@2.4.2_mysql2@3.18.1_@types+node@22.19.18__sqlite3@5.1.7_/node_modules/bookshelf/lib/eager.js:52:15
ghost-cacie  |     at /var/lib/ghost/versions/6.42.0/node_modules/.pnpm/lodash@4.18.1/node_modules/lodash/lodash.js:13500:38
ghost-cacie  |     at /var/lib/ghost/versions/6.42.0/node_modules/.pnpm/lodash@4.18.1/node_modules/lodash/lodash.js:4998:15
ghost-cacie  |     at baseForOwn (/var/lib/ghost/versions/6.42.0/node_modules/.pnpm/lodash@4.18.1/node_modules/lodash/lodash.js:3037:24)
ghost-cacie  |     at Function.mapValues (/var/lib/ghost/versions/6.42.0/node_modules/.pnpm/lodash@4.18.1/node_modules/lodash/lodash.js:13499:7)
ghost-cacie  |     at EagerRelation.morphToFetch (/var/lib/ghost/versions/6.42.0/node_modules/.pnpm/bookshelf@1.2.0_knex@2.4.2_mysql2@3.18.1_@types+node@22.19.18__sqlite3@5.1.7_/node_modules/bookshelf/lib/eager.js:51:28)
ghost-cacie  |     at EagerRelation.eagerFetch (/var/lib/ghost/versions/6.42.0/node_modules/.pnpm/bookshelf@1.2.0_knex@2.4.2_mysql2@3.18.1_@types+node@22.19.18__sqlite3@5.1.7_/node_modules/bookshelf/lib/eager.js:25:19)
ghost-cacie  |     at EagerRelation.<anonymous> (/var/lib/ghost/versions/6.42.0/node_modules/.pnpm/bookshelf@1.2.0_knex@2.4.2_mysql2@3.18.1_@types+node@22.19.18__sqlite3@5.1.7_/node_modules/bookshelf/lib/base/eager.js:67:14)
ghost-cacie  |     at EagerRelation.tryCatcher (/var/lib/ghost/versions/6.42.0/node_modules/.pnpm/bluebird@3.7.2/node_modules/bluebird/js/release/util.js:16:23)
ghost-cacie  |     at EagerRelation.fetch (/var/lib/ghost/versions/6.42.0/node_modules/.pnpm/bluebird@3.7.2/node_modules/bluebird/js/release/method.js:15:34)
ghost-cacie  |     at Child._handleEager (/var/lib/ghost/versions/6.42.0/node_modules/.pnpm/bookshelf@1.2.0_knex@2.4.2_mysql2@3.18.1_@types+node@22.19.18__sqlite3@5.1.7_/node_modules/bookshelf/lib/collection.js:527:73)
ghost-cacie  |     at Child.<anonymous> (/var/lib/ghost/versions/6.42.0/node_modules/.pnpm/bookshelf@1.2.0_knex@2.4.2_mysql2@3.18.1_@types+node@22.19.18__sqlite3@5.1.7_/node_modules/bookshelf/lib/collection.js:179:27)
ghost-cacie  |     at PassThroughHandlerContext.finallyHandler (/var/lib/ghost/versions/6.42.0/node_modules/.pnpm/bluebird@3.7.2/node_modules/bluebird/js/release/finally.js:57:23)
ghost-cacie  |     at PassThroughHandlerContext.tryCatcher (/var/lib/ghost/versions/6.42.0/node_modules/.pnpm/bluebird@3.7.2/node_modules/bluebird/js/release/util.js:16:23)
ghost-cacie  |     at Promise._settlePromiseFromHandler (/var/lib/ghost/versions/6.42.0/node_modules/.pnpm/bluebird@3.7.2/node_modules/bluebird/js/release/promise.js:547:31)

Code of Conduct

• I agree to be friendly and polite to people in this repository