CVE-2026-103275: Ghost 5.42.2 before 6.58.0 Password Hash Disclosure
Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other staff users' password hashes from which filters match and perform offline password-guessing attacks against them.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghostto a version that resolves this vulnerability.Fixed in 6.58.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs staff-level access to the Ghost Admin API. The issue is not described as exploitable by an unauthenticated external user.
What access or capability does exploitation require?
The attacker must be able to use the Admin API bulk post or page edit and delete endpoints and submit filters against restricted fields such as authors.password. They can infer password hashes based on whether those filters match.
What is the practical impact after a hash is inferred?
An attacker can use the inferred password hash in offline password-guessing attempts against other staff users. The stated impact is limited to confidentiality; no integrity or availability impact is identified.
Which versions are affected?
Ghost versions from 5.42.2 before 6.58.0 are affected. Version 6.58.0 is outside the stated affected range.