CVE-2026-70590 in Ghost
Summary
by MITRE • 08/05/2026
Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Depending on the database used, leaked hashes may not have had the correct casing for all characters, increasing the difficulty of a password-guessing attack. This issue is fixed in version 6.54.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The Ghost content management system suffered from a critical information disclosure vulnerability that allowed staff-level users to access hashed passwords of other staff members through the administrative API. This vulnerability existed in versions prior to 6.54.1 and represented a significant security flaw in the permission model implementation. The issue stemmed from insufficient access controls within the Ghost Admin API endpoints, which failed to properly validate user permissions when retrieving user account information. Attackers with staff-level credentials could exploit this weakness to enumerate password hashes without proper authorization, creating an avenue for targeted credential compromise attempts.
The technical nature of this vulnerability aligns with CWE-284 Access Control Issues, specifically concerning improper access control mechanisms within the application's administrative interface. The flaw allowed unauthorized data exposure through API calls that should have been restricted to authorized personnel only. When staff members accessed the Ghost Admin API to retrieve user information, the system did not properly verify whether the requesting user had appropriate clearance levels to view other users' password hashes. This represents a classic case of insufficient authorization checks where the application failed to enforce proper role-based access control policies.
The operational impact of this vulnerability created serious risk for organizations using Ghost CMS, as it enabled attackers to obtain password hashes that could potentially be cracked through offline brute force or dictionary attacks. While the system's Device Verification mechanisms were designed to prevent login attempts with recovered credentials, the mere exposure of hashed passwords significantly reduced the security posture. The vulnerability was particularly concerning because it provided attackers with material for credential stuffing campaigns against other services where users might have reused passwords. The fact that database-specific casing issues affected some hash formats further complicated password recovery efforts but did not eliminate the underlying security risk.
Security practitioners should note that this vulnerability demonstrates the importance of implementing proper access control checks even within administrative interfaces where users already possess elevated privileges. The fix implemented in version 6.54.1 addressed the root cause by strengthening API endpoint authorization mechanisms and ensuring that user account information remains properly protected regardless of the requesting user's permissions level. Organizations using Ghost CMS should immediately update to version 6.54.1 or later, conduct thorough security audits of their administrative access controls, and review all staff-level user credentials for potential compromise. The vulnerability also highlights the need for comprehensive monitoring of API access patterns and implementing proper logging mechanisms to detect unauthorized information disclosure attempts.
This issue relates to several ATT&CK techniques including T1566 Credential Stuffing and T1580 Lateral Movement through compromised credentials, although it primarily operates as an information gathering step before potential exploitation. The vulnerability's remediation process emphasizes the critical nature of maintaining proper access control boundaries even within trusted administrative interfaces, aligning with security best practices outlined in NIST SP 800-53 and ISO 27001 standards for information security management. Organizations should implement regular security assessments of their content management systems to identify similar access control gaps that could lead to unauthorized data exposure.