CVE-2026-103275 in Ghost
Summary
by MITRE • 10/01/2026
Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other staff users' password hashes from which filters match and perform offline password-guessing attacks against them.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in Ghost versions prior to 6.58.0 represents a critical information disclosure flaw within the Admin API, specifically affecting bulk post and page edit or delete endpoints. This issue stems from an incomplete remediation of CVE-2026-70590, indicating that previous security patches failed to fully address the underlying architectural weakness in how query filters are processed. The core technical defect lies in the application's handling of filter parameters on restricted fields, most notably authors.password. While these endpoints are designed to restrict access to sensitive data such as password hashes for staff-level users, the implementation allows attackers to pass specific filter criteria targeting these protected columns during bulk operations.
From a technical perspective, this vulnerability enables an attacker with Staff-level privileges to perform timing-based or error-based inference attacks against other staff accounts. By submitting requests that include filters on restricted fields like authors.password, the application's response behavior changes depending on whether the filter matches existing data in the database. For instance, if a query includes a condition such as password equals a specific hash value, and the system returns a different HTTP status code or response time compared to when no match is found, an attacker can iteratively test potential values. This side-channel allows for the extraction of password hashes without direct access to those fields through standard API responses, effectively bypassing the intended authorization controls designed to protect credential data.
The operational impact of this vulnerability is severe due to its implications for account security and lateral movement within a compromised environment. Staff-level attackers can leverage extracted password hashes to conduct offline brute-force or dictionary attacks against other staff members' accounts. Since modern web applications typically store passwords using strong hashing algorithms such as bcrypt, the extraction of these hashes significantly lowers the barrier for credential compromise if weak passwords are in use. Once an attacker obtains valid credentials for a higher-privileged account, they can escalate their access to Administrator level, gaining full control over the Ghost instance, including the ability to modify site settings, inject malicious content, or exfiltrate sensitive user data stored within the platform.
This vulnerability aligns with CWE-209, which describes the generation of an error message that reveals sensitive information, and more specifically CWE-778, insufficient logging on critical events if such inference is detected in logs, though primarily it falls under CWE-200 for exposure of sensitive information through side channels. In terms of the MITRE ATT&CK framework, this behavior corresponds to T1539, Steal Web Session Cookie, and potentially T1110, Brute Force, as the extracted hashes are directly used in offline password cracking attempts. The incomplete fix nature also highlights a failure in regression testing during security patch deployment, underscoring the need for rigorous validation of access control logic across all API endpoints after updates.
To mitigate this vulnerability, organizations running Ghost versions before 6.58.0 must upgrade to version 6.58.0 or later immediately upon availability. This update contains the complete fix that properly restricts filtering on sensitive fields within bulk operation endpoints. In environments where upgrading is not immediately feasible, administrators should implement strict input validation and sanitization at a reverse proxy level to block requests containing filters targeting restricted columns such as password hashes. Additionally, enabling comprehensive audit logging for API access can help detect anomalous query patterns indicative of inference attacks, allowing security teams to identify potential exploitation attempts in real-time. Regular penetration testing focused on authorization bypasses is also recommended to ensure that future patches do not introduce similar incomplete fixes.