CVE-2026-70590 describes an information exposure vulnerability in Ghost CMS versions before 6.54.1. Staff-level users could retrieve hashed passwords of other staff users through the Admin API. The hashes could be subjected to offline password-guessing attacks, which might result in account takeover if successful. However, device verification mechanisms were expected to prevent attackers from logging in even if passwords were recovered. Additionally, depending on the database, the leaked hashes might have incorrect character casing, complicating guessing attacks. The vulnerability is addressed in Ghost version 6.54.1.

The vulnerability allows staff-level users to access hashed passwords of other staff users, exposing sensitive credential data. Successful offline password-guessing attacks could lead to account takeover, impacting confidentiality and integrity of user accounts. Device verification reduces the risk of unauthorized logins with compromised credentials. There is no indication of availability impact. The CVSS score of 4.8 reflects a medium severity with network attack vector, high attack complexity, and required privileges.

Upgrade Ghost to version 6.54.1 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are documented. Device verification provides some mitigation but does not eliminate the risk. Patch status is not explicitly stated as 'official-fix' in the advisory, but the description confirms the issue is fixed in 6.54.1.