CVE-2026-103275: Ghost 5.42.2 before 6.58.0 Password Hash Disclosure

Q: Who can exploit this issue?

An attacker needs staff-level access to the Ghost Admin API. The issue is not described as exploitable by an unauthenticated external user.

Q: What access or capability does exploitation require?

The attacker must be able to use the Admin API bulk post or page edit and delete endpoints and submit filters against restricted fields such as authors.password. They can infer password hashes based on whether those filters match.

Q: What is the practical impact after a hash is inferred?

An attacker can use the inferred password hash in offline password-guessing attempts against other staff users. The stated impact is limited to confidentiality; no integrity or availability impact is identified.

Q: Which versions are affected?

Ghost versions from 5.42.2 before 6.58.0 are affected. Version 6.58.0 is outside the stated affected range.

Published Oct 1, 2026

Updated

Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other staff users' password hashes from which filters match and perform offline password-guessing attacks against them.

Affected Software

1 affected component

Ghost Ghost>=5.42.2<6.58.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Ghost to a version that resolves this vulnerability.
Fixed in 6.58.0

Event History

Oct 1, 2026

CVE Published

via MITRE·10:42 AM

Data Sourced

via MITRE·10:42 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs staff-level access to the Ghost Admin API. The issue is not described as exploitable by an unauthenticated external user.

What access or capability does exploitation require?

The attacker must be able to use the Admin API bulk post or page edit and delete endpoints and submit filters against restricted fields such as authors.password. They can infer password hashes based on whether those filters match.

What is the practical impact after a hash is inferred?

An attacker can use the inferred password hash in offline password-guessing attempts against other staff users. The stated impact is limited to confidentiality; no integrity or availability impact is identified.

Which versions are affected?

Ghost versions from 5.42.2 before 6.58.0 are affected. Version 6.58.0 is outside the stated affected range.

CVE-2026-103275: Ghost 5.42.2 before 6.58.0 Password Hash Disclosure

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access or capability does exploitation require?

What is the practical impact after a hash is inferred?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access or capability does exploitation require?

What is the practical impact after a hash is inferred?

Which versions are affected?