CVE-2026-70590
published 2026-08-04CVE-2026-70590: Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the…
PriorityP425medium4.8CVSS 3.1
AVNACHPRHUIRSUCLIHAN
EPSS
0.19%
9.4th percentile
Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Depending on the database used, leaked hashes may not have had the correct casing for all characters, increasing the difficulty of a password-guessing attack. This issue is fixed in version 6.54.1.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ghost | ghost | >= 0 < 6.54.1 | 6.54.1 |
| tryghost | ghost | < 6.54.1 | 6.54.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Ghost: Blind Password Hash Disclosure in Ghost Admin API
ghsa·2026-08-04
CVE-2026-70590 [MEDIUM] CWE-200 Ghost: Blind Password Hash Disclosure in Ghost Admin API
Ghost: Blind Password Hash Disclosure in Ghost Admin API
### Impact
Any staff-level user was able to leak the hashed passwords of other staff users. An offline password-guessing attack against the hashes could lead to account takeover if successful, but [Device Verification](https://docs.ghost.org/security#device-verification) should have prevented an attacker from logging in with a recovered password. Depending on the database used, leaked hashes may not have had the correct casing for all characters, increasing the difficulty of a password-guessing attack.
### Vulnerable versions
This vulnerability is present in Ghost versions v6.54.0 and earlier.
### Patches
v6.54.1 contains a fix for this issue.
### How to update
For self-hosters using Docker, find [Docker's official Ghost imag
VulDB
TryGhost up to 6.54.0 Admin API privileges management
vuldb·2026-08-04·CVSS 4.8
CVE-2026-70590 [MEDIUM] TryGhost up to 6.54.0 Admin API privileges management
A vulnerability, which was classified as problematic, has been found in TryGhost Ghost up to 6.54.0. This affects an unknown part of the component Admin API. This manipulation causes improper privilege management.
This vulnerability is handled as CVE-2026-70590. The attack can be initiated remotely. There is not any exploit available.
It is advisable to upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-04
Published