CVE-2026-70590 Details
Description
Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Depending on the database used, leaked hashes may not have had the correct casing for all characters, increasing the difficulty of a password-guessing attack. This issue is fixed in version 6.54.1.
A vulnerability exists in Ghost, a Node.js content management system, allowing staff-level users to access the hashed passwords of other staff members through the Ghost Admin API. This could lead to account takeover via an offline password-guessing attack, although successful recovery of passwords might be mitigated by Ghost's Device Verification feature. Additionally, the leaked password hashes could be improperly cased, depending on the database, further complicating password recovery efforts.
Users can update to Ghost version 6.54.1, which addresses this vulnerability. For self-hosters using Docker, instructions for updating are available in the Ghost Docker documentation. Those with a Ghost-CLI installation can refer to the Ghost update documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 4, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/TryGhost/Ghost/commit/63c31fad7e473caa62d8fbb4651a04a2a62b5d00 | [email protected] | Source CodeVendor |
| https://github.com/TryGhost/Ghost/pull/29628 | [email protected] | Source CodeVendor |
| https://github.com/TryGhost/Ghost/releases/tag/v6.54.1 | [email protected] | Release NotesVendor |
| https://github.com/TryGhost/Ghost/security/advisories/GHSA-jm22-3w23-5q7w | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Ghost | < 6.54.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | New CVE Received | [email protected] |