CVE-2026-70590: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in TryGhost Ghost
Ghost, a Node.js content management system, had a vulnerability prior to version 6.54.1 where staff-level users could access hashed passwords of other staff users via the Ghost Admin API. This exposure could allow offline password-guessing attacks potentially leading to account takeover, although device verification was intended to mitigate unauthorized logins. The vulnerability is fixed in version 6.54.1.
AI Analysis
Technical Summary
CVE-2026-70590 describes an information exposure vulnerability in Ghost CMS versions before 6.54.1. Staff-level users could retrieve hashed passwords of other staff users through the Admin API. While the hashes could be subjected to offline guessing attacks, device verification mechanisms were designed to prevent unauthorized logins even if passwords were recovered. Additionally, depending on the database, some leaked hashes might have incorrect character casing, complicating guessing attacks. The issue is resolved in Ghost version 6.54.1.
Potential Impact
The vulnerability allows staff-level users to access hashed passwords of other staff users, potentially enabling offline password-guessing attacks. Successful guessing could lead to account takeover with high impact on integrity. Confidentiality is also impacted due to exposure of sensitive password hashes. Availability is not affected. Device verification is expected to reduce the risk of unauthorized login despite password compromise.
Mitigation Recommendations
Upgrade Ghost to version 6.54.1 or later to remediate this vulnerability. No other official remediation or temporary fixes are documented. Patch status is confirmed fixed in 6.54.1.
CVE-2026-70590: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in TryGhost Ghost
Description
Ghost, a Node.js content management system, had a vulnerability prior to version 6.54.1 where staff-level users could access hashed passwords of other staff users via the Ghost Admin API. This exposure could allow offline password-guessing attacks potentially leading to account takeover, although device verification was intended to mitigate unauthorized logins. The vulnerability is fixed in version 6.54.1.
CVSS v3.1
Score 4.8medium
Affected software
TryGhost
Ghost
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-70590 describes an information exposure vulnerability in Ghost CMS versions before 6.54.1. Staff-level users could retrieve hashed passwords of other staff users through the Admin API. While the hashes could be subjected to offline guessing attacks, device verification mechanisms were designed to prevent unauthorized logins even if passwords were recovered. Additionally, depending on the database, some leaked hashes might have incorrect character casing, complicating guessing attacks. The issue is resolved in Ghost version 6.54.1.
Potential Impact
The vulnerability allows staff-level users to access hashed passwords of other staff users, potentially enabling offline password-guessing attacks. Successful guessing could lead to account takeover with high impact on integrity. Confidentiality is also impacted due to exposure of sensitive password hashes. Availability is not affected. Device verification is expected to reduce the risk of unauthorized login despite password compromise.
Mitigation Recommendations
Upgrade Ghost to version 6.54.1 or later to remediate this vulnerability. No other official remediation or temporary fixes are documented. Patch status is confirmed fixed in 6.54.1.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-04T19:50:27.327Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a725cbabf8831d5398274f5
Added to database: 08/04/2026, 21:42:18 UTC
Last enriched: 08/12/2026, 15:51:16 UTC
Last updated: 09/17/2026, 22:01:37 UTC
Views: 61
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.